github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

debianopenssl

debianopenssl Claves privadas vulnerables al fallo de OpenSSL en Debian CVE-2008-0166 En 2008, un fallo en el paquete OpenSSL de Debian y Ubuntu provocó la generación de claves privadas predecibles. Aunque el número de claves es limitado, se necesitan algunas consideraciones para crear una lista...

punk.py

punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...

shhgit

🚨 shhgit ya no se mantiene. Si necesitas soporte o consultoría para tus esfuerzos de escaneo de secretos, envíame un correo electrónico a [email protected] 🚨 shhgit ayuda a proteger a los equipos de desarrollo, operaciones y seguridad con visión de futuro al encontrar secretos en su código...

quantum

Algoritmo de Shor para ECDLP — Presentación al Q-Day Prize Solucionador cuántico para el Problema del Logaritmo Discreto de Curva Elíptica ECDLP, construido para el Q-Day Prize Challenge por Project Eleven. El objetivo: recuperar claves privadas ECC en hardware cuántico real utilizando el algorit...

DockerSpy

DockerSpy DockerSpy busca imágenes en Docker Hub y extrae información sensible como secretos de autenticación, claves privadas y más. ¿Qué es Docker? Docker es una plataforma de código abierto que automatiza el despliegue, escalado y gestión de aplicaciones utilizando tecnología de...

gpg_reaper

GPG Reaper TL;DR: Obtain/Steal/Restore GPG Private Keys from gpg-agent cache/memory This POC demonstrates method for obtaining GPG private keys from gpg-agent memory under Windows. Normally this should be possible only within 10 minutes time frame --default-cache-ttl value. Unfortunately...

CVE-2019-14222

CVE-2019-14222: Certificado predeterminado en Alfresco Community Alfresco Community 5.x y versiones anteriores incluye por defecto un conjunto de certificados privados conocidos. Cualquier persona que descargue e instale el software Alfresco Community en una máquina local obtiene acceso a estos...

gitrob

Gitrob: Putting the Open Source in OSINT Gitrob is a tool to help find potentially sensitive files pushed to public repositories on Github. Gitrob will clone repositories belonging to a user or organization down to a configurable depth and iterate through the commit history and flag files that...

DumpsterDiver

DumpsterDiver por @Rzepsky DumpsterDiver es una herramienta que puede analizar grandes volúmenes de datos en busca de secretos codificados como claves por ejemplo, AWS Access Key, Azure Share Key o claves SSH o contraseñas. Además, permite crear reglas de búsqueda simples con condiciones básicas...

CVE-2026-54872

A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm ECDSA or SM2, using curves withou...

CVE-2026-100710

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get, Domains::listing, SubDomains::get, and the admin branch of SubDomains::listing perform a wildcard SELECT over the paneldomains table and return the row unmodified, including the paneldomains.dkimprivkey...

CVE-2026-100710

Froxlor versions through 2.3.10 are vulnerable to a sensitive data exposure issue because the application fails to filter specific columns from API responses. Specifically, the functions Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a...

CVE-2026-100708: Exposure of Sensitive Information to an Unauthorized Actor

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

CVE-2026-86059

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

JFrog Artifactory 7.161.x < 7.161.16 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is 7.161.x prior to 7.161.16. It is, therefore, affected by the following vulnerabilities. - An authentication weakness that, under default configuration, may allow an unauthenticated...

CVE-2026-45726 Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in...

EUVD-2026-82401

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in...

CVE-2026-27557

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint to read the SSH server's private keys , resulting in high confidentiality impact with no integrity or availability impact (CVSS 3.1: 7.5 HIGH ). The specific affected p...

CVE-2026-27557 Path Traversal in /index.php/view_uploaded_iodd_file

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/viewuploadedioddfile endpoint allowing the SSH server's private keys to be read...