CVE-2026-26287

The External Secrets Operator is vulnerable to a label enforcement bypass in the webhook generator due to an incorrect initialization order. Specifically, the EnforceLabels flag is incorrectly cleared after being set, causing the provider-side check for the external-secrets.io/type=webhook label ...

GHSA-Q7HV-XX6H-Q2X8 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

Summary A bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabels after it was set, resulting in the provider-side check for external-secrets.io/type=webhook being skipped and the operation to succeed while it should have failed with secret...

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

Summary A bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabels after it was set, resulting in the provider-side check for external-secrets.io/type=webhook being skipped and the operation to succeed while it should have failed with secret...

GitMiner3

作者: UnkL4b サイト: bravul.com ブログ: unkl4b.github.io Github: UnkL4b X: @UnkL4b 警告 +---------------------------------------------------+ | DEVELOPERS ASSUME NO LIABILITY AND ARE NOT | | RESPONSIBLE FOR ANY MISUSE OR DAMAGE CAUSED BY | | THIS PROGRAM |...

CVE-2025-68664-LangGrinch-PoC

📑 Table of Contents 🎯 Executive Summary 📂 Project Structure 🚀 Quick Start 🐛 Vulnerability Deep Dive 🔬 Technical Root Cause Analysis ⚔️ Attack Chain Methodology 💀 Payload Arsenal 55+ 🎮 Operator's Strategy Guide...

langgrinch-cve-2025-68664-analysis

LangGrinch 취약점 분석: CVE-2025-68664 개요 이 저장소는 LangChain Core에 영향을 미치는 직렬화 주입 취약점인 LangGrinch라고도 알려진 CVE-2025-68664를 분석한 기술 보고서를 포함합니다. 이 보고서는 취약점 배경, 근본 원인, 악용 흐름, 위협 모델, 완화 전략, 그리고 LLM 기반 애플리케이션에 대한 실제 보안 영향을 설명합니다. 다루는 주제 LangChain 직렬화 및 역직렬화 안전하지 않은 역직렬화 / CWE-502 LLM 애플리케이션 보안 전달 경로로서의 프롬프트 인젝션...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – 포스트퀀텀 KEM 타이밍 부채널 Kyber 역캡슐화 개요 Kyber KEM 역캡슐화의 취약한 구현은 암호문 거부 단계의 타이밍 차이를 통해 비밀 키 비트를 유출하여 전체 키 복구를 가능하게 합니다. 심각도: 치명적 개인 키 손상 취약한 서버 C 및 공격 스크립트 Python // kybervulndecaps.c - Simulated vulnerable Kyber decapsulation include include include include // Secret key simplified, 16...

CVE-2026-94299

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...

redact

redact ログ、テレメトリ、その他いかなる第三者向け出力先に到達する前に、自由形式の文字列から認証情報らしき内容を除去します phpboyscout Go toolkit の一部 — go-tool-base から抽出された、小さなフレームワーク非依存のGoモジュール集です。ドキュメント: redact.go.phpboyscout.uk gitlab.com/phpboyscout/go/redact は、信頼済みと非信頼の可観測性サーフェス — テレメトリベンダー、ログ集約サービス、メトリクスストア — の境界...

trufflehog v3.98.0

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

CVE-2026-46726

CVE-2026-46726 — camel-vertx-websocket Header Injection SSRF + Secret Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| WebSocket feed ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 +...

PT-2026-107128

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

PT-2026-106775

Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/sdk versions 1.12.0 through 1.30.1 @modelcontextprotocol/client versions 2.0.0 through 2.1.0 Description The SDK's OAuth client support allows an MCP server to determine which authorization server receives the client's...

PT-2026-107253

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description An issue exists where an attacker with access to the server secret and Redis write access can submit a malicious serialized cache value. Upon retrieval, the deserialization process can...

CVE-2026-103433

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...

EUVD-2026-92818

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...

CVE-2026-103433 Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...

CVE-2026-103433 Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...

CVE-2026-103433 Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...

CVE-2026-103433

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...