gha-lab-b16a4f3554

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of qgis/QGIS at commit...

vibe-coding-security

Vibe Coding Security Before you tweet your launch, run these 69 checks. They map to the exact patterns behind the Lovable RLS CVE CVE-2025-48757, 170+ apps, 2025, the Moltbook leak 1.5M API tokens, Feb 2026, and the April 2026 Lovable platform breach source code + service keys of other users'...

CVE-2026-104417

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

CVE-2026-104417

The Ghost platform (versions 1.20.0 before 6.64.0 ) is vulnerable to a path traversal flaw in the theme translation file loading mechanism. This issue allows authenticated administrators to manipulate the locale setting to load JSON files from locations outside the active theme directory. Success...

CVE-2026-104417 Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

EUVD-2026-91428

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

jsluicepp

📄 Table of Contents 👋 Introduction 🛠️ Setup 📝 Usage 📜 Features Monitor URLs Send to Repeater Secrets Secret Notifications Copy URL Positive/Negative Match In-scope only In-line Tags Hide Duplicates Show Parameterized Import/Export Save Settings 🤝 Contributors 👋 Introduction jsluice++ is a Burp...

gha-lab-3b0a828a69

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gluestack/gluestack-ui at commit...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra Contributing License Future Plans/Under Development Credits Disclaimer FAQ Detailed insight about Vajra can b...

gato

!WARNING Este repositorio está obsoleto y archivado Gato ha sido sustituido por Trajan , la herramienta multiplataforma de detección de vulnerabilidades y automatización de ataques en CI/CD de Praetorian. Trajan consolida las capacidades de ataque CI/CD de GitHub Actions Gato y GitLab Glato en un...

gh-hijack-runner

gh-hijack-runner A python script to create a fake GitHub runner and hijack pipeline jobs to leak CI/CD secrets. Discover more details in the following blogpost: https://www.synacktiv.com/publications/hijacking-github-runners-to-compromise-the-organization Exploitation If you can obtain a...

actions-secrets

SecureStack Secrets Analysis GitHub Action A GitHub Action that analyses your source code for secrets, credentials, API keys, server and database hostnames/URLS, and a lot more! When you add this to GitHub Actions we will analyze your source code to make sure there is no sensitive data in your...

CVE-2025-55183

CVE-2025-55183 Escáner para la vulnerabilidad de exposición del código fuente de React Server Functions. ¿Qué es esto? CVE-2025-55183: Las Server Actions de React 19.0.0-19.2.1 pueden ser explotadas para exponer su código fuente completo, incluyendo secretos hardcodeados, claves API y credenciale...

infisical

The open-source secret management platform : Sync secrets/configs across your team/infrastructure and prevent secret leaks. Community | Infisical Cloud | Self-Hosting | Docs | Website | X | Hiring Remote/SF Introduction Infisical is the open source security infrastructure platform that teams use...

CVE-2026-79899 Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

CVE-2021-34824

CVE-2021-34824 repro reproducing an old istio bug This set of scripts and manifests will aid in exploring an old Istio security issue which allowed malicious Istio users to access Kubernetes secrets they should not have access to. This reproduction is modeled on this blog post which has some...

CVE-2026-103257

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...

CVE-2026-103246

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification...

autonoma

Autonoma Autonoma detecta secretos hardcodeados y los reemplaza con referencias aos.environ... usando reescrituras del AST. Los cambios se aplican solo cuando la reescritura es determinista y preserva la semántica. Las reescrituras usan el árbol sintáctico analizado — no regex sobre texto crudo...

CVE-2026-103257

The automation platform n8n is vulnerable to a path traversal vulnerability in versions prior to 1.123.80, 2.39.6, and 2.40.1. The root cause is a failure to validate resource identifiers within the n8n node. An attacker can craft malicious resource IDs to redirect API calls to unintended targets...