CVE-2025-10294

Exploit: Bypass de autenticación mediante ownidsharedsecret vacío falsificación de JWT 1 Forjar un JWT válido usando una clave HMAC vacía root@kitploit: SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode...

aigate

aigate Higiene de secretos para código generado por IA. Detecta credenciales codificadas en prompts, entradas de herramientas, código generado y archivos existentes. Inicio rápido root@kitploit: pip install aigate && aigate setup-all Eso es todo. Esto instala un proxy en segundo plano modo redact...

mcp-doorman

mcp-doorman La puerta de seguridad para servidores MCP: cada llamada a herramienta se verifica en la entrada. CI npm Licencia: Apache-2.0 PRs bienvenidos mcp-doorman es un proxy plug-and-play que se sitúa entre tu agente de IA Claude Desktop, Claude Code, Cursor, VS Code, cualquier cliente MCP y...

CVE-2026-19117 Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only...

CVE-2026-19117

CVE-2026-19117 affects Delinea Secret Server in on-premises deployments . Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and subsequently authenticate as that user, effectively bypassing authentication. The vulnerability is rat...

CVE-2026-3288-lab

CVE-2026-3288 Vulnerable Lab Docker NGINX Ingress Controller Configuration Injection ⚠️ WARNING : This lab contains intentionally vulnerable configurations for AUTHORIZED SECURITY TRAINING ONLY Vulnerability Overview CVE-2026-3288 CVSS 8.8 HIGH - Configuration injection in NGINX Ingress Controller...

CVE-2026-77123

Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API . An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from API responses. The vu...

EUVD-2026-70230

Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. Thi...

CVE-2026-77123 Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API

Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. Thi...

iron-proxy

iron-proxy El problema Los trabajos de CI, los agentes de codificación con IA y los contenedores en sandbox pueden realizar solicitudes salientes arbitrarias. Una dependencia comprometida, una inyección de prompt o un paso de compilación malicioso pueden exfiltrar secretos, comunicarse con el...

CVE-2026-84651

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

infisical

The open-source secret management platform : Sync secrets/configs across your team/infrastructure and prevent secret leaks. Slack | Infisical Cloud | Self-Hosting | Docs | Website | Twitter | Hiring Remote/SF Introduction Infisical is the open source security infrastructure platform that teams us...

EUVD-2026-70117

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

CVE-2026-84651

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

Reporter: Cavan Loughran, Celvex Group Inc. Summary ------- The /snippets/filepath route handler serveSnippets in kernel/server/serve.go performs a bare filepath.Joinutil.SnippetsPath, filePath on the single-decoded c.Request.URL.Path and serves the result with c.File, with NO IsSubPath containme...

LeitWacht

GitLab Runner Leitwacht Control de salida de red para contenedores CI/CD de GitLab Runner. Leitwacht previene ataques a la cadena de suministro que exfiltran secretos, controlando lo que cada contenedor de trabajo puede acceder en la red. Cómo Funciona Leitwacht es un agente independiente que se...

Malicious code in onceaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52acfee73c36f7df40ac54204cef235483203b7dec9208d5b219cb7068d341f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15844 Malicious code in onceaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52acfee73c36f7df40ac54204cef235483203b7dec9208d5b219cb7068d341f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15843 Malicious code in is-generator-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93931fecef2da94abf1de73e282da2c510715512d61bfe8afd1197925f4b6e08 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

JSAnalyzer

JS Analyzer - Extensión de Burp Suite por Jensec https://x.com/jensec Una potente extensión de Burp Suite para análisis estático de JavaScript. Extrae endpoints de API, URLs, secretos y direcciones de correo electrónico de archivos JavaScript con un filtrado inteligente de ruido. El objetivo es...