CVE-2026-91992

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

EUVD-2026-78664

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

CVE-2026-91992 Tornado before 6.5.7 Credential Leak via Handle Reuse

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

CVE-2026-91992

Tornado (Python async web framework) versions before 6.5.7 contain a credential leak in CurlAsyncHTTPClient caused by pycurl handles being reused across requests without proper state clearing. A remote attacker can issue requests through the same client instance, causing TLS certificates or proxy...

PT-2026-92106

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

Linux Distros Unpatched Vulnerability : CVE-2026-91992

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state...

CVE-2025-44203

CVE-2025-44203：HotelDruid 3.0.0 / 3.0.7 敏感信息泄露与拒绝服务 摘要 HotelDruid 3.0.0 和 3.0.7 在 creadb.php 设置端点上存在一个竞争条件，该端点在设置完成前可被访问。它有两种影响，均源于同一次掉入的竞争：敏感信息泄露（通过详细的 SQL 错误消息）和拒绝服务。 通过一次性发送大量 POST 请求，攻击者可触发竞争条件并从响应中读取敏感数据，包括管理员用户名、密码哈希和盐值。如果在 Debian 软件包配置期间选择的密码较弱，则可通过词表离线恢复。...

Estudo-de-Caso-CVE-2024-21413

CVE-2024-21413 — Moniker Link 🔗💀 Microsoft Outlook RCE + Filtración de Credenciales NTLM ⚠️ Aviso Legal: Este repositorio es exclusivamente con fines educativos y de investigación en seguridad. Todas las demostraciones se realizaron en entornos controlados y aislados. El uso de estas técnicas...

CVE-2025-50154

NTLM/SMB 加固与威胁狩猎工具包 作者： w01f 版本： 1.0 用途： 审计、加固并搜寻不安全的 NTLM/SMB 使用，以降低诸如 CVE-2025-50154 等风险。 CVE-2025-50154 概述 严重程度： 高 类型： NTLM 凭据泄露 + 补丁绕过（零点击） 影响系统： Windows 10/11，Windows Server 摘要： CVE-2025-50154 是对微软先前针对 CVE-2025-24054 补丁的绕过。即便已应用之前的缓解措施，精心构造的文件或 UNC 路径仍可触发 Windows 资源管理器 获取远程资源，并在无任何用户交互...

apkprobe

APKprobe Descompilador de APK y escáner de secretos para investigación de seguridad en Android. Extrae automáticamente claves de API , endpoints , tokens y otras credenciales filtradas de aplicaciones Android. Funciona con archivos .apk, .xapk, .dex, .jar, .class, .smali, .zip, .aar, .arsc, .aab...

CVE-2025-23040

CVE-2025-23040 - Credential Leak in GitHub Desktop GitHub Desktop 3.4.12 容易受到一种攻击，该攻击允许通过恶意远程URL泄露凭据。攻击者可以说服用户克隆一个被篡改的仓库，从而获取用户名和OAuth令牌。...

Fedora 45 : composer (2026-249d41312c)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-249d41312c advisory. Version 2.10.3 - 2026-08-27 Security: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Security:...

CVE-2026-89011

A flaw was found in isomorphic-git. This prototype pollution vulnerability in the getRemoteInfo function allows a malicious Git server operator to manipulate object properties by advertising specially crafted reference names. This can reroute network operations through an attacker-controlled prox...

PT-2026-89398

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...

PT-2026-89393

Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...

CVE-2026-86082

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

PT-2026-88513

Impact The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain...

EulerOS 2.0 SP12 : perl-HTTP-Tiny (EulerOS-SA-2026-3369)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx...

AZL-99870 CVE-2026-19931 affecting package tensorflow 2.16.1-11

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...