552 matches found
apk.sh
🕹️ apk.sh apk.sh is a Bash script that makes reverse engineering Android apps easier, automating some repetitive tasks like pulling, decoding, rebuilding and patching an APK. Features apk.sh basically uses apktool to disassemble, decode and rebuild resources and some bash to automate the frida...
SecretSifter
OWASP SecretSifter SecretSifter is an OWASP Incubator project that finds credentials exposed in what web applications actually deliver to the browser: JavaScript bundles, configuration responses and other live content. Pre-deployment secret scanning looks at source code. Some credentials are only...
CVE-2026-123082
Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token a JWT in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when i...
CVE-2026-123082 Docker Desktop logs can expose the Docker Hub access token
Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token a JWT in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when i...
CVE-2026-123082
Docker Desktop versions prior to 4.94.0 are vulnerable to a flaw where the signed-in user's Docker Hub access token (JWT) is written in cleartext to application logs and diagnostics bundles. This occurs because IPC payloads consisting of bare JSON strings or arrays were not redacted before loggin...
EUVD-2026-121149
Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token a JWT in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when i...
CVE-2026-123082: Docker Docker Desktop: Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to…
Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token a JWT in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when i...
PT-2026-141722
Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token a JWT in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when i...
CVE-2026-47097
A flaw was found in AJA HELO Plus. The device firmware uses a static Advanced Encryption Standard AES passphrase to encrypt diagnostic export bundles. An unauthenticated remote attacker can extract this shared key and download encrypted diagnostics from an unauthenticated endpoint, allowing them ...
UBUNTU-CVE-2026-99264
In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b "iouring/net: commit partial buffers on retry" commits ring provided buffers when a receive is going to be retried after a partial transfer, so that another...
CVE-2026-99264
In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b "iouring/net: commit partial buffers on retry" commits ring provided buffers when a receive is going to be retried after a partial transfer, so that another...
PT-2026-135054
Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...
openSUSE 16 Security Update : hauler (openSUSE-SU-2026:22201-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22201-1 advisory. Changes in hauler: - update vendor: CVE-2026-114437: github.com/go-chi/chi/v5: client IP spoofing in ClientIPFromXFF via X-Forwarded-For...
CVE-2026-111089: Apache Software Foundation Apache Wicket: Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes…
Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...
CLEANSTART-2026-GS29486 MessagePack for C# is a MessagePack serializer for C#
Security vulnerability affects the azure-functions-extension-bundles package. MessagePack for C is a MessagePack serializer for C...
EUVD-2026-110827
Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are...
Oracle Java SE 27.0.1 eMudhra Certificate Detector
A Python tool that audits Java JKS and PKCS12 trust stores and PEM bundles for eMudhra-related certificate indicators associated with CVE-2026-91403...
HCL BigFix Platform security vulnerabilities
A security vulnerability exists in HCL BigFix Platform versions 11.0.7 and earlier, as well as 10.0.16 and earlier. This vulnerability stems from the use of Mozilla CA certificate bundles PEM. Bundles released prior to version 2026/10/20 still trust certificates with compromised private keys, whi...
PT-2026-120911
This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passed to its markup. This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph...