CVE-2026-19300 Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields...

EUVD-2026-71260

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material secretkey, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories — by supplying absolute pat...

CVE-2026-85700

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers , allowing any authenticated user with basic permissions to call GET /tool/{tool_id} or GET /tool endpoints and retrieve plaintext authorization headers and third-party API keys defined by administrat...

CVE-2026-85595

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary...

CVE-2026-85595 Traefik before v2.11.55 Authentication Bypass via digestAuth

Traefik versions before v2.11.55 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authenticatio...

CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary...

CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary...

CVE-2026-85595

Traefik versions before v2.11.55 contain an authentication bypass in the digestAuth middleware . The root cause is that unknown usernames receive an empty secret instead of being rejected, allowing an attacker to compute a valid digest response using that empty secret and arbitrary credentials. T...

CVE-2026-85588

phpMyFAQ versions before 4.1.8 embed live TOTP shared secrets in plaintext inside user data export ZIP files. An attacker who obtains an exported archive can extract the TOTP seed and generate valid one-time codes, effectively bypassing two-factor authentication . The CVSS 4.0 base score is 5.3 (...

CVE-2026-85588 phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

redash-reset

redash-reset Esto utilizará una clave REDASHSECRETKEY predeterminada de c292a0a3aa32397cdb050e233733900f, lo que permite restablecer la contraseña del ID de usuario, pero necesitará conocer la dirección de correo electrónico asociada a él. Información...

super-secret-finder

super-secret-finder Plugin de Burp para la coincidencia de secretos...

chart-down

chart-down Download and scan Helm charts for secrets using TruffleHog. Given a Helm repository URL, chart-down fetches the repo index, downloads every chart archive, extracts it, and runs TruffleHog against the contents. Requisitos Go 1.19+ TruffleHog en PATH brew install trufflehog Instalación...

Flask-Unsign

Flask Unsign Herramienta de línea de comandos para obtener, decodificar, descifrar por fuerza bruta y manipular cookies de sesión de una aplicación Flask adivinando claves secretas. Para el componente independiente de lista de palabras, visita el repositorio flask-unsign-wordlist. Requisitos Pyth...

DumpsterDiver

DumpsterDiver por @Rzepsky DumpsterDiver es una herramienta que puede analizar grandes volúmenes de datos en busca de secretos codificados como claves por ejemplo, AWS Access Key, Azure Share Key o claves SSH o contraseñas. Además, permite crear reglas de búsqueda simples con condiciones básicas...

Git-Secret

Git-Secret Scripts en Go para encontrar una clave API / algunas palabras clave en un repositorio Actualización V1.0.2 🚀 Eliminación de algunos verificadores Añadido archivo de ejemplo que contiene dorks de GitHub Añadido soporte para el comando go install issue 5 Captura de pantalla 📷 Cómo instal...

Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

MAL-2026-15871 Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

dumpscan

El desarrollo público de esta herramienta se ha pausado, pero todavía se está trabajando en privado. Espere una actualización masiva en el tercer/cuarto trimestre de 2024. Dumpscan es una herramienta de línea de comandos diseñada para extraer y volcar secretos de kernels y formatos de Minidump de...

noseyparker

Nosey Parker ahora es reemplazado por Titus. Nosey Parker está oficialmente retirado Consulte nuestra publicación de anuncio https://www.praetorian.com/blog/titus-open-source-secret-scanner/. El repositorio de Titus se puede encontrar en https://github.com/praetorian-inc/titus Descripción general...