git-hound

🐾 GitHound Um apanhador de segredos que combina padrões, ataca patches e captura em lote. Visão Geral O GitHound caça chaves de API, segredos e credenciais expostas no GitHub combinando GitHub dorks com correspondência de padrões, detecção contextual e análise do histórico de commits. Insira um...

CVE-2026-81027

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

ed25519-unsafe-libs

ed25519-unsafe-libs Attacco Oracle alla Funzione di Firma Ed25519 con Doppia Chiave Pubblica Un elenco di librerie di firma ed25519 potenzialmente non sicure che espongono un'API pubblica in cui chiave segreta e chiave pubblica possono essere fornite indipendentemente come input della funzione di...

CVE-2025-53690-Analysis

CVE-2025-53690: Analyse der Sitecore ViewState Deserialization Schwachstelle Überblick CVE-2025-53690 ist eine ViewState-Deserialisierungsschwachstelle in der Sitecore-Produktfamilie, die durch die Ausnutzung offengelegter ASP.NET-Machine-Keys eine Remote-Codeausführung ermöglicht – eine kritisch...

CVE-2026-27944

CVE-2026-27944 - Nginx UI Nicht authentifizierter Backup-Download & Entschlüsselung https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red Ein Proof-of-Concept-Exploit PoC für CVE‑2026‑27944, eine kritische...

CVE-2024-24919

Einführung Einfaches POC-Python-Skript, das die Check-Point-Sicherheitslücke CVE-2024-24919 Wrong Check Point prüft und ausnutzt; anfällig für beliebiges Dateilesen. Voraussetzungen Python 3 Pip Erforderliche Bibliothek/Modul Installation über PIP requests urllib3 tqdm So wird es ausgeführt...

Leaked-Credentials

...

CVE-2026-29988

Milesight IoT devices (multiple models, affected firmware versions) are vulnerable to cleartext transmission of sensitive information through the NFC interface. An unauthenticated attacker with physical proximity can read LoRaWAN ABP NwkSKey , AppSKey , and D2D keys via a simple NFC read operatio...

EUVD-2026-66229

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...

EUVD-2026-66228

duplicate record...

ledger-app-monero-1.42-vuln

CVE-2020-6861: Extração da chave de gasto do aplicativo Monero da Ledger Repositório de PoC para o artigo: https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html...

GHSA-72F3-6W86-7RV3 @arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

Summary The self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes POST /mcp without any authentication: createMcpExpressApp is called without an authProvider and no middleware guards the route, so any network-reachable client can issue an unauthenticated initialize request and obtain...

Bluetooth-Attacks-CVE-2025-27840

Este artigo discute como um atacante pode introduzir uma lista oculta de vulnerabilidades por meio de atualizações de módulos, o que pode levar ao comprometimento de dispositivos ESP32 e à obtenção de acesso não autorizado a chaves privadas, afetando bilhões de dispositivos que usam este...

CVE-2020-11651-PoC

CVE-2020-11651-PoC Repository che contiene un exploit CVE-2020-11651 aggiornato per funzionare con le ultime versioni di Python e gestire gli errori relativi alle connessioni. COPIA DEL README DAL REPOSITORY ORIGINALE Repository Originale Exploit PoC per CVE-2020-11651 e CVE-2020-11652 Questo è u...

Zoho ManageEngine - getUserAPIKey Authentication Bypass

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...

Netmaker - Hardcoded DNS Secret Key

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. id: CVE-2023-32077 info: name: Netmaker - Hardcoded DNS Secret Key author: iamnoooob,rootxharsh,pdresearch...

CVE-2025-53694

CVE-2025-53694: Divulgação de Informações na API ItemService com um usuário anônimo restrito, levando à exposição de chaves de cache usando uma abordagem de força bruta A API ItemService, acessível em /sitecore/shell/api/sitecore/ItemService/GetChildren, permite que usuários não autenticados...

CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...

CVE-2025-44823

Esposizione autenticata di chiavi API in Nagios Log Server 2024R1.3.1 ▶️ PoC Demo ID CVE: CVE-2025-44823 Data: 2025-04-02 Autori: Alex Tisdale, Seth Kraft Homepage del fornitore: https://www.nagios.com/ Changelog del fornitore: https://www.nagios.com/changelog/log-server Link del software:...