actions-secrets

GitHub Action di analisi dei segreti di SecureStack Una GitHub Action che analizza il tuo codice sorgente alla ricerca di segreti, credenziali, chiavi API, hostname/URL di server e database, e molto altro! Quando aggiungi questo alle GitHub Actions analizzeremo il tuo codice sorgente per...

Gemini-api-key-hunter

Toolkit per chiavi API Gemini Un toolkit per scoprire, validare e testare chiavi API Google Gemini esposte. È composto da due componenti: Gemisc.py – Uno scanner Python ad alta velocità che scopre chiavi API Google esposte da siti web e file JavaScript, le verifica tramite l'API Gemini e identifi...

keyguard

keyguard Scansiona codebase, progetti GCP e pipeline CI per credenziali API di Google esposte — prima che vengano sfruttate. Il problema: Google ha abilitato retroattivamente l'accesso all'API Gemini su chiavi API esistenti Maps, Places, ecc. progettate per essere pubbliche e incorporate nel codi...

Palo Alto Expedition - SQL Injection

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expeditio...

CVE-2022-1442

CVE-2022-1442 Plugin Metform per WordPress = 2.1.3 - Controllo degli accessi improprio che consente la divulgazione non autenticata di informazioni sensibili Descrizione Il plugin è vulnerabile alla divulgazione di informazioni sensibili a causa di un controllo degli accessi improprio nel file...

EUVD-2026-65090

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

uncover

Quickly discover exposed hosts on the internet using multiple search engines. Features • Installation • Usage • Configuration • Running Uncover • Join Discord uncover is a go wrapper using APIs of well known search engines to quickly discover exposed hosts on the internet. It is built with...

GitLeaks

Componente GitLeaks GitLab CI Um componente GitLab CI para Gitleaks - uma ferramenta SAST para detetar e prevenir segredos codificados como palavras-passe, chaves de API e tokens em repositórios git. Funcionalidades Deteção de Segredos : Analisa repositórios em busca de segredos codificados e...

kyubisweep

🦊 KyubiSweep Scova i segreti esposti con l'astuzia di una volpe! Uno strumento CLI leggero e cross‑platform che scansiona il tuo filesystem per rilevare segreti esposti, chiavi API e token. Realizzato con Go per massime prestazioni e zero dipendenze. ✨ Caratteristiche 🔍 30+ Pattern di Segreti –...

git-hound

🐾 GitHound A pattern-matching, patch-attacking, batch-catching secret snatcher. Overview GitHound hunts down exposed API keys, secrets, and credentials across GitHub by pairing GitHub dorks with pattern matching, contextual detection, and commit-history analysis. Input a GitHub dork into GitHound...

CVE-2026-75626 SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

CVE-2026-72631

Kibana Fleet vulnerability CVE-2026-72631: Improper Privilege Management can allow an Elastic Agent API key issued to agents in a policy to gain additional write rights (insert new documents and extend index mappings) for certain indices by including extra data streams in the integration policy. ...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CVE-2026-73086

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CVE-2026-14450 Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...

EUVD-2026-54740

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and...

CVE-2026-16594 WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and...

CVE-2026-16594

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and...

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...