CVE-2026-119599

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating serviceaccount API keys with unvalidated scopes. Attackers holding writeapikeys can mint keys with readchannels and query /admin/graphql to read every...

DockerSpy

DockerSpy DockerSpy searches for images on Docker Hub and extracts sensitive information such as authentication secrets, private keys, and more. What is Docker? Docker is an open-source platform that automates the deployment, scaling, and management of applications using containerization...

CVE-2026-119547

A flaw was found in Forgejo. The GetPublicKey Application Programming Interface API handler does not enforce ownership checks during key lookups. An authenticated remote attacker with read access can exploit this flaw by enumerating sequential key identifiers, resulting in information disclosure ...

CVE-2025-69428

Security Advisory - CVE-2025-69428 Title: Unauthenticated Access to Sensitive Directory Information Disclosure CVE-ID: CVE-2025-69428 Description A critical access control vulnerability in locally deployed Pro-Bit application in versions less than v1.77.4 allows unauthenticated attackers to...

yara

!IMPORTANT This project is in maintenance mode. More info: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/ YARA in a nutshell YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malwar...

synodecrypt

SynoDecrypt A tool to decrypt all Synology encrypted archives SPK, PAT, .... The reverse engineering work is explained in our blog post. Installation pip install -r requirements.txt Usage You first have to extract the encryption keys and put them into a JSON file e.g. into keys.json. This JSON fi...

CVE-2026-119599

AxonHub versions through 1.0.0-beta11 are vulnerable to a privilege escalation vulnerability (CWE-266) caused by unvalidated scopes when creating service_account API keys. This flaw allows project users to assign system-level scopes. Specifically, an attacker with write_api_keys can mint keys con...

EUVD-2026-113936

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating serviceaccount API keys with unvalidated scopes. Attackers holding writeapikeys can mint keys with readchannels and query /admin/graphql to read every...

CVE-2026-119599 AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating serviceaccount API keys with unvalidated scopes. Attackers holding writeapikeys can mint keys with readchannels and query /admin/graphql to read every...

CVE-2026-119569

Parse Server versions before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 are vulnerable to a prototype pollution vulnerability. The root cause is the lack of own-property checks when expanding user-controlled keys into objects. An attacker with class write access can submit dot notation field keys or...

CVE-2026-41490

CVE-2026-41490 — SQL Injection in Dagster database I/O managers via dynamic partition keys Severity : High CVSS 8.3 CWE : CWE-89 — SQL Injection Affected : Dagster core = 1.13.0 and integration packages = 0.29.0 Fixed in : Dagster core 1.13.1 and integration packages 0.29.1 Advisory :...

keypairvuln

keypair vulnerable keys CVE-2021-41117 Keys generated with versions of the keypair javascript library vulnerable to CVE-2021-41117. Due to bugs in the random number generator this library will generate certain keys with higher likelyhood. The likelyhood of generating one of the keys in this repo...

CVE-2026-119547

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain...

certdepot

Certificate Depot A free online tool for generating self-signed SSL/TLS certificates in seconds. No signup required. Website: cert-depot.com Features Generate self-signed certificates with RSA 2048/4096 or ECDSA P-256/P-384 keys Download as ZIP PEM key + certificate or PFX PKCS12 Automatic SAN...

nextjs-supabase-stripe-security-checker

nextjs-supabase-stripe-security-checker Free, local security scan for Next.js + Supabase + Stripe apps: leaked keys, missing RLS and grants, unsafe Stripe webhooks. Your AI agent shipped the app. Did it also ship your Stripe secret key, a table without RLS, or a webhook that anyone can call? One...

ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns

The system certificate authority CA store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle...

persistence-info.github.io

The repository tries to gather an information about Windows persistence mechanisms to make the protection/detection more efficient. Most of the information is well known for years, being actively used within various scenarios. Expect more. I am doing my best to add new entries each day. How it...

twebit

Bitcoin analysis with machine learning How it works? 1- Get tweets from twitter 2- Filter tweets 3- Tweet classification with naive bayes algorithm Positive,negative and neut Installation git clone https://github.com/omergunal/twebit cd twebit pip3 install -r requirements.txt Update your api keys...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite Checkpoint SQL Injection CVE-2025-67644 is a SQL Injection vulnerability CWE-89 in the langgraph-checkpoint-sqlite package part of LangGraph / LangChain ecosystem. It allows an attacker to inject arbitrary SQL via unsanitized metadata filter keys passed to th...

CVE-2018-20555

CVE-2018-20555 The Wordpress Plugin called Social Network Tabs, made by the company Design Chemical, is leaking twice the Twitter accesstoken, accesstokensecret, consumerkey and consumersecret of their user which is leading to a takeover of their Twitter account. This is caused by the following...