NPM: Trigger.dev: V1 coordinator default-secret unauth Socket.IO

NPM: Trigger.dev: V1 coordinator default-secret unauth Socket.IO vulnerability discovered by ? in WordPress Npm trigger.dev versions 4.5.4...

GHSA-GG6R-GP4C-89HP Trigger.dev: V1 coordinator default-secret unauth Socket.IO

TL;DR The /coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret "coordinator-secret" baked into source. The override variable isn't documented in the self-host docs, .env.example, or helm values, so any operator who didn't read source ships with the...

boatcrash

boatcrash Эксплойт для CVE-2019-19030, затрагивающий Harbor версий Используйте этот скрипт на экземплярах Harbor, работающих на версиях ниже 1.10.3 или 2.0.1, для перечисления всех проектов, присутствующих на платформе. Его также можно использовать для перечисления проектов на более новых версиях...

screenscrub

screenscrub Ищет учетные данные на скриншотах, извлекает их в менеджер секретов и безвозвратно редактирует их на изображениях — чтобы секреты не гнили в ваших заметках, скриншотах и /Desktop. Локальный. Офлайн. Бесшумный. По умолчанию без сети и телеметрии. screenscrub объединяет две существующие...

CVE-2026-12392

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

EUVD-2026-91775

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392

An information exposure vulnerability exists in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 . An unauthenticated attacker can retrieve the RPC secret in plaintext via the vendor data metadata endpoint . This is specifically possible if a target machine was deployed wi...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

secretsdump.py

secretsdump.py 설명 이것은 impacket Python 라이브러리의 secretsdump.py 스크립트를 사용자 정의한 버전입니다. 여러 Windows 시스템에서 동시에 시크릿NTDS.dit, SAM 및 .SYSTEM 레지스트리 하이브을 추출할 수 있습니다. 이 사용자 정의 버전은 대상 호스트 목록이 포함된 입력 파일을 받아들이고 더 빠른 작업을 위해 멀티스레딩을 지원하여 원본을 개선합니다. 사용법 스크립트를 실행하는 기본 구문은 다음과 같습니다: python3 secretsdump.py...

xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release

I have a minimized safe Rust witness for xxhash-rust 0.8.15. Safe public route: xxhashrust::xxh3::xxh364withsecret&0x41, & The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debugassert!. Release-Miri...

GHSA-6G2R-675J-HX59 xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release

I have a minimized safe Rust witness for xxhash-rust 0.8.15. Safe public route: xxhashrust::xxh3::xxh364withsecret&0x41, & The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debugassert!. Release-Miri...

CVE-2026-23922

A flaw was found in Zabbix. A highly privileged user, such as a Super Admin, can exploit this vulnerability. By setting a malicious 'Token endpoint' in the email media OAuth configuration, the 'Client secret' can be leaked. This leads to information disclosure of sensitive credentials...

gha-lab-e8902eccd3

자동화된 연구 산출물 — 업스트림 프로젝트가 아님. 이 저장소는 Université Laval의 석사 논문을 위해 자동화된 하네스가 구축한 일회용 실험실로, 게시된 GitHub Actions 워크플로우 취약점을 재현하기 위한 것입니다. 이는 커밋 2a209b058c60823b57e8b7775b10244ff340eb8b 2025-05-14 시점의 timescale/pgai의 축어적 스냅샷이며, 해당 프로젝트의 자체 라이선스 하에 재배포되며, 그 라이선스 파일은 이 스냅샷에 변경 없이 포함되어 있습니다. 업스트림 프로젝트는 관여하...

CVE-2026-104416

Ghost versions 4.39.0 through 6.64.0 are vulnerable to an information disclosure vulnerability within the Admin API . This flaw allows staff users with invite viewing permissions to access secret tokens for pending staff invites. By obtaining these tokens, an attacker can accept invites for highe...

EUVD-2026-91427

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

CVE-2026-18036

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-97317

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured...

WordPress Giveaways and Contests by RafflePress plugin < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure vulnerability

Unauthenticated reCAPTCHA Secret Key Disclosure vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Giveaways and Contests by RafflePress versions 1.12.27...