git-hound

🐾 GitHound Инструмент для поиска секретов с использованием сопоставления шаблонов, анализа патчей и пакетного сбора данных. Обзор GitHound ищет раскрытые ключи API, секреты и учётные данные на GitHub, комбинируя GitHub-дорки с сопоставлением шаблонов, контекстным анализом и анализом истории...

Zoho ManageEngine - getUserAPIKey Authentication Bypass

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...

Leaked-Credentials

Google Chrome의 개발자 도구Developer Tools와 정규식을 사용하여 유출된 자격 증명을 검색하려면 다음 간단한 단계를 따르세요: 1. DevTools 열기: Chrome에서 검사 중인 사이트로 이동한 다음 Ctrl+Shift+IWindows/Linux 또는 Cmd+Option+ImacOS를 눌러 개발자 도구를 엽니다. 2. 네트워크 탭으로 이동: "Network" 탭을 클릭합니다. 3. 정규식 검색 활성화: 필터 막대에서 정규식 아이콘을 클릭하여 정규식 모드를 활성화합니다. 4. 페이지 새로고침: 모든 네트워...

threat-intel-brief-cve-2026-42208-litellm

위협 인텔리전스 브리핑 - CVE-2026-42208: BerriAI LiteLLM SQL 인젝션 CVE: CVE-2026-42208 GHSA: GHSA-r75f-5x8p-qvmc CVSS 점수: 9.3 치명적 영향을 받는 소프트웨어: BerriAI LiteLLM 버전 = 1.81.16, 1.83.7 수정 버전: 1.83.7-stable 2026년 4월 19일 릴리스 CISA KEV 등록: 2026년 5월 8일 출처: CISA KEV, Sysdig TRT, The Hacker News, Security Affairs 요약...

Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

Public Runtime Config Exposes Ollama API Key to Browser Clients Summary [email protected] unconditionally merges all module options — including apikey — into Nuxt's public runtime config runtimeConfig.public.ollama. Nuxt serializes runtimeConfig.public into the SSR HTML response inside a payload...

GHSA-FXG7-897C-57MP Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

Public Runtime Config Exposes Ollama API Key to Browser Clients Summary [email protected] unconditionally merges all module options — including apikey — into Nuxt's public runtime config runtimeConfig.public.ollama. Nuxt serializes runtimeConfig.public into the SSR HTML response inside a payload...

Security Bulletin: Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

Summary Langflow and its bundled connectors perform server-side HTTP requests using URLs supplied by authenticated users without consistently applying the platform's connector SSRF validation guard. The MCP server configuration URL field accepts any HTTP or HTTPS target including RFC 1918,...

CVE-2025-44823

Уязвимость раскрытия API-ключей в Nagios Log Server 2024R1.3.1 ▶️ PoC Demo Идентификатор CVE: CVE-2025-44823 Дата: 2025-04-02 Авторы: Alex Tisdale, Seth Kraft Сайт вендора: https://www.nagios.com/ Журнал изменений вендора: https://www.nagios.com/changelog/log-server Ссылка на ПО:...

CVE-2026-85700

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers , allowing any authenticated user with basic permissions to call GET /tool/{tool_id} or GET /tool endpoints and retrieve plaintext authorization headers and third-party API keys defined by administrat...

CVE-2026-85700 Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in customheaders, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/toolid or GET /tool endpoints to retrieve plaintext authorization headers and...

EUVD-2026-71149

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in customheaders, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/toolid or GET /tool endpoints to retrieve plaintext authorization headers and...

CVE-2026-71963

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...

EUVD-2026-70526

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...

CVE-2026-71963

Hermes Agent versions 0.18.2 through 0.21.0 are vulnerable to remote code execution via a crafted .git/config file in a malicious repository. The agent executes git status or git diff before trust prompts are presented to the user; by setting core.fsmonitor to an attacker-controlled command, an a...

CVE-2026-71963 Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...

CVE-2026-75760

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

EUVD-2026-68309

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

CVE-2026-82640

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

CVE-2026-82640 browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

EUVD-2026-68216

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...