Google-api-key-scanner

Overview A Python tool for testing Google Maps API keys against 21 different Google API endpoints to check which services are exposed and vulnerable. !IMPORTANT 🎥 For a complete walkthrough of the tool, watch the demo video here: https://youtu.be/3KMUnLdlOSE. The feature shown below starts at...

cspparse

cspparse Description cspparse is a tool to evaluate Content Security Policies. It uses Google's API to retrieve the CSP Headers and returns them in ReconJSON format. Not only does it check for headers with Google's API, it also parses the target site's HTML to look for any CSP rules that are...

keyguard

keyguard Scan codebases, GCP projects, and CI pipelines for exposed Google API credentials — before they get exploited. The problem: Google retroactively enabled Gemini API access on existing API keys Maps, Places, etc. that were designed to be public and embedded in client-side code. When someon...

cspparse

cspparse Descrizione cspparse è uno strumento per valutare le Content Security Policies. Utilizza l'API di Google per recuperare gli header CSP e li restituisce in formato ReconJSON. Non solo controlla gli header tramite l'API di Google, ma analizza anche l'HTML del sito target per cercare...

Google Api Private Key Detection

Google API private keys are exposed in files. !/usr/bin/env python3 -- coding: utf-8 -- """Google API private keys are exposed in files.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Google Api Private Key...

arkindex-base-worker (>=0.3.2rc7, <=0.3.6rc1), disk-usage-exporter (>=0.0.1, <=0.1.0) +14 more potentially affected by CVE-2026-54552 via sh (>=2.0.2, <=2.2.2)

sh PYPI version =2.0.2, =0.3.2rc7, =0.0.1, =0.0.1, =1.0.0, =1.0.20, =0.0.2, =0.0.1, =0.8.9, =4.5.0, =23.10.20rc0, =0.1.6, =0.6.14, =0.1.5, =1.0.19, =1.0.20 and more Source cves: CVE-2026-54552 Source advisory: OSV:GHSA-Q38V-WP89-2W55...

SUSE-RU-2026:2816-1 Recommended update for python-aioresponses, python-google-api-core, python-google-api-python-client, python-google-auth, python-google-auth-httplib2, python-google-cloud-appengine-logging, python-google-cloud-artifact-registry, python-google-cloud-audit-log, python-google-cloud-build, python-google-cloud-compute, python-google-cloud-core, python-google-cloud-dns, python-google-cloud-domains, python-google-cloud-iam, python-google-cloud-kms, python-google-cloud-kms-inventory, python-google-cloud-logging, python-google-cloud-run, python-google-cloud-secret-manager, python-google-cloud-service-directory, python-google-cloud-spanner, python-google-cloud-storage, python-google-cloud-vpc-access, python-google-crc32c, python-google-resumable-media, python-googleapis-common-protos, python-grpc-google-iam-v1, python-grpc-interceptor, python-mmh3, python-mypy, python-opentelemetry-resourcedetector-gcp, python-poetry-core, python-proto-plus, python-pytest-asyncio, python-syrupy, python-typed-ast, python-uritemplate, python-dnspython, python-trio, python-websocket-client

This update for python-aioresponses, python-google-api-core, python-google-api-python-client, python-google-auth, python-google-auth-httplib2, python-google-cloud-appengine-logging, python-google-cloud-artifact-registry, python-google-cloud-audit-log, python-google-cloud-build,...

WS-2019-0252

In google-api-nodejs-client, versions before 39.1.0 are vulnerable to Improper Authorization. Setting credentials to one client may apply to all clients which may cause requests to be sent with the incorrect credentials...

GHSA-MVV8-V4JJ-G47J Directus: Sensitive fields exposed in revision history

Summary Directus stores revision records in directusrevisions whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields including user tokens, two-factor authentication secrets, external auth...

CVE-2023-4021

The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in versions up to, but not including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2025-204629

The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcalajaxhandler function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in t...

CVE-2025-12898

CVE-2025-12898 is a published vulnerability affecting the Pretty Google Calendar plugin for WordPress. The connected Wordfence report confirms a missing capability check in pgcal_ajax_handler() that allowed unauthenticated access and enabled retrieval of the plugin’s Google API key from settings ...

CVE-2025-12898 Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure

The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcalajaxhandler function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in t...

CVE-2025-12898: Missing Authorization

The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcalajaxhandler function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in t...

PT-2025-52535

Name of the Vulnerable Software and Affected Versions Pretty Google Calendar plugin for WordPress versions prior to 2.0.1 Description The Pretty Google Calendar plugin for WordPress is susceptible to unauthorized data access. This is due to a missing capability check within the pgcal ajax handler...

EUVD-2005-3864

Malware in sbrugna...

EUVD-2018-13380

Malware in sbrugna...

EUVD-2023-58989

Malicious code in bioql PyPI...

CVE-2023-6777

The WP Go Maps formerly WP Google Maps plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due to the plugin adding the API key to several plugin files. This makes it possible for unauthenticated attackers to obtain the developer's...

WordPress WP JobHunt plugin wp_ajax_google_api_login_callback function authentication error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WP JobHunt...