github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

CVE-2023-5070

CVE-2023-5070 Social Media Share Buttons & Social Sharing Icons = 2.8.5 - Information Exposure Description: The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsisaveexport...

CVE-2026-19600

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

EUVD-2026-102744

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

CVE-2026-19600 Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

PYSEC-2026-4301 Snowflake drivers writes sensitive information to logs

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : PyJWT vulnerabilities (USN-8916-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8916-1 advisory. YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC...

curl: curl: Authorization: Negotiate sent to foreign origin

A flaw was found in curl. When processing an HTTP redirect to an address containing user credentials, curl improperly retains and retransmits authentication state. A malicious server can exploit this behavior by redirecting curl to an untrusted destination, forcing the client to transmit sensitiv...

Linux Distros Unpatched Vulnerability : CVE-2026-78357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. A...

USN-8916-1: PyJWT vulnerabilities

YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to forge authentication tokens. This issue only affected Ubuntu 26.04 LTS. CVE-2026-102266 Rohan Das discovered that PyJWT incorrectly handled...

CVE-2026-7767

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to...

CVE-2026-7767 URL Redirection to Untrusted Site ('Open Redirect') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to...

CVE-2026-7767

GitLab CE/EE versions 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are vulnerable to an Open Redirect in the Kubernetes proxy . Due to improper redirect validation , an authenticated user controlling a Kubernetes agent could cause sensitive authentication tokens to be sent to a...

UBUNTU-CVE-2026-78357

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

PT-2026-111172

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.11 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description An issue exists in the Kubernetes proxy where improper redirect validation allows an authenticated user...

EUVD-2026-97267

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

CVE-2026-5047

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords...

EUVD-2026-94756

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords...

CVE-2026-5047

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords...