envsec

envsec Secure environment secrets management using native OS credential stores. Demo Features Store secrets in your OS native credential store not plain text files Cross-platform: macOS, Linux, Windows Organize secrets by context e.g. myapp.dev, stripe-api.prod, work.staging Track secret metadata...

git-remote-gcrypt

================= git-remote-gcrypt Repositorio git remoto cifrado con GNU Privacy Guard :Sección del manual: 1 Descripción git-remote-gcrypt es un ayudante de remoto git para enviar y recibir desde repositorios cifrados con GnuPG, utilizando un formato personalizado. Este ayudante de remoto mane...

pub

❤ Be a Hero, tip a 🍺 🙂 ⟶ Ƀ : 1AZMeGVfCBbYwVYyG9s79pJDyocTZgiApa | Ξth : 0x438B38E30eF117C15fBfF833f9C2c70182925815 Exploit PoCs and tools for vulnerabilities disclosed by tintinweb. pub root@kitploit: police line - do not cross ==== police line - do not cross ==== police line - do not cross ====...

CVE-2025-49113

Exploit de CVE-2025-49113 para Roundcube Un exploit en Python para CVE-2025-49113, dirigido a una vulnerabilidad en el webmail de Roundcube que permite la ejecución remota de código mediante la deserialización de objetos PHP. Descripción general Este exploit aprovecha una vulnerabilidad de...

scallion

2020 Project Update Scallion was a hobby project to learn OpenCL and RSA. We are not currently maintaining scallion. It has bitrotted in two important ways: 1. Tor has moved on to v3 Onion addresses, which scallion does not support. Old v2 addresses will stop working in October of 2021. The new...

gpg_reaper

GPG Reaper TL;DR: Obtain/Steal/Restore GPG Private Keys from gpg-agent cache/memory This POC demonstrates method for obtaining GPG private keys from gpg-agent memory under Windows. Normally this should be possible only within 10 minutes time frame --default-cache-ttl value. Unfortunately...

gpg_reaper

GPG Reaper TL;DR: Obtener/Robar/Restaurar Claves Privadas GPG de la caché/memoria de gpg-agent Este POC demuestra un método para obtener claves privadas GPG de la memoria de gpg-agent en Windows. Normalmente esto solo debería ser posible dentro de un período de 10 minutos valor de...

git-crypt

git-crypt - transparent file encryption in git git-crypt enables transparent encryption and decryption of files in a git repository. Files which you choose to protect are encrypted when committed, and decrypted when checked out. git-crypt lets you freely share a repository containing a mix of...

terrapod-PoC

Terrapod: security advisory CVE status: requested, pending assignment. This finding is published as GHSA-6qrc-597p-mrp9. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-terrapod-PoC and this banner is replaced with the CVE link. | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

codecrypt

Codecrypt The post-quantum cryptography tool. Codecrypt is currently unmaintained, although I still successfully use it. If you are interested in developing/maintaining it, ping me. About This is a GnuPG-like unix program for encryption and signing that uses only quantum-computer-resistant...

CVE-2026-81714

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

CVE-2026-81700

opensslencrypt versions before 1.4.9 contain a signature verification vulnerability in gpgrunner.verifydetached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing key...

CVE-2026-81714 openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

CVE-2026-81714

openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 are vulnerable to a plugin-signing trust anchor enrollment bypass in the enroll_trust_key function. The function uses suffix-tolerant fingerprint matching , so an operator who confirms a short (~32-bit) GPG key ID could unknowingly en...

EUVD-2026-67064

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

CVE-2026-81714 openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

CVE-2026-81700 openssl_encrypt before 1.4.9 GPG Signature Verification Bypass

opensslencrypt versions before 1.4.9 contain a signature verification vulnerability in gpgrunner.verifydetached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing key...

EUVD-2026-67056

opensslencrypt versions before 1.4.9 contain a signature verification vulnerability in gpgrunner.verifydetached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing key...

CVE-2026-81700

openssl_encrypt versions before 1.4.9 contain a signature verification bypass in the gpg_runner.verify_detached function. The root cause is that the function only checks the VALIDSIG status without inspecting REVKEYSIG , EXPKEYSIG , or GPG exit codes, causing it to accept revoked and expired sign...