EUVD-2026-91427

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

CVE-2026-104416 Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

CVE-2026-104416

Ghost versions 4.39.0 through 6.64.0 are vulnerable to an information disclosure vulnerability within the Admin API . This flaw allows staff users with invite viewing permissions to access secret tokens for pending staff invites. By obtaining these tokens, an attacker can accept invites for highe...

LogMePwn

LogMePwn LogMePwn est une boîte à outils de scan et de validation entièrement automatisée, multi-protocole, fiable et ultra-rapide pour la vulnérabilité Log4J RCE CVE-2021-44228. Points forts de l'outil Support inhérent de la génération automatique de Canary Tokens via emails ou webhooks. Support...

Leaktopus

Avis de dépréciation Chers utilisateurs de Leaktopus, Nous souhaitons vous informer que le projet Leaktopus sera officiellement abandonné. Après une évaluation minutieuse, nous avons décidé d'arrêter le développement actif et la maintenance de cette bibliothèque. Qu'est-ce que cela signifie pour...

vertx-web-xsrf

Présentation L'implémentation CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl dans Vert.x Web ne crée pas de jetons CSRF uniques par session utilisateur. Un site malveillant peut toujours effectuer une CSRF en obtenant un jeton CSRF valide et en l'ajoutant à un formulaire HTML, puis...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

prompt_injection

Бенчмарк кросс-поверхностных промпт-инъекций Бенчмарк для измерения того, на каком этапе конвейера выполнения LLM-агента, использующего инструменты, срабатывает защита от промпт-инъекций — а где не срабатывает. Встраивает уникальные канареечные токены SECRET-A-F0-98 в инъецированные полезные...

CTF-2021

CTF-2021 Заметки Этот CTF не использует БД для аутентификации. В дополнение к этому, данный CTF генерирует статические токены по следующим причинам: 1. Минимизировать шансы решения CTF пользователем альтернативным способом 2. Минимизировать вероятность того, что пользователь пропустит подсказки,...

ClaimJumper

/ | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| || | | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 Профессиональный инструментарий для тестирования безопасности JWT. Анализируйте, взламывайте, подделывайте и эксплуатируйте JSON Web...

JWT-Bruteforcer

JWT-Bruteforcer Базовый инструмент JWT Bruteforcer с тестом на уязвимость CVE-2018-1000531 Импортированные библиотеки: jwt base64 Требуется минимальная версия python 3.6...

CVE-2026-103273 Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level...

CVE-2026-103273 Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level...

EUVD-2026-90666

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level...

CVE-2026-103664

MISP is vulnerable to reflected cross-site scripting (XSS) in the analyst data notes panel. The root cause is the lack of sanitization or type enforcement on the seed path parameter supplied via the URL, which is passed directly into inline JavaScript within the HTML response. An authenticated at...

CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-82827

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82827 A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82827

The Hitachi Coding Software Suite (versions through 3.3.0 ) is vulnerable to a Use of Hard-coded Cryptographic Key flaw. The software uses a hard-coded JWT signing secret key , which enables an attacker to generate unauthorized Bearer tokens . By using these fraudulent tokens, an attacker can exp...

CVE-2026-82827 A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...