CVE-2026-100615 Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikeymanager to rotate a higher-privileged orgsuperadmin sibling key and recover its plaintext credential. Attackers with apikeymanager role can enumerate same-owner API keys, rotate a strong...

virustotalx

エンドポイント向け virustotalx IP向け virustotalx V2 インストール root@kitploit: git clone https://github.com/orwagodfather/virustotalx.git root@kitploit: cd virustotalx 3つのアカウントを https://www.virustotal.com/gui/join-us で作成し、3つのAPIキーをコピーしてください === root@kitploit: nano orwa.sh & root@kitploit: nano orwaV2.sh...

EUVD-2026-67810

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

CVE-2026-82279

HyperDX through version 1.10.1 fails to enforce role-based access control on team management endpoints, allowing any authenticated team member (low privileges) to perform administrative actions. Specifically, requests to PATCH /team/apiKey , PATCH /team/name , and DELETE /team/member can be used ...

CVE-2026-82279 HyperDX Team Management Operations Missing Role-Based Access Control

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

PT-2026-83302

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

CVE-2026-2451

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when name is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It was possible to exfiltrate information...