CVE-2026-79960 Gitea deploy key pushes acting as the repository owner

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-79960 Gitea deploy key pushes acting as the repository owner

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-79960

The Gitea repository management platform contains a vulnerability where pushes authenticated with a deploy key are incorrectly recorded as being performed by the repository owner. This Incorrect Authorization (CWE-863) causes permission checks in the push hook pipeline to evaluate the owner's pri...

EUVD-2026-93918

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-79960 Gitea deploy key pushes acting as the repository owner

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-103059

A flaw in Gitea allows an authentication bypass when the built-in SSH server is enabled (START_SSH_SERVER = true). The root cause is the use of an SQL LIKE comparison for looking up public keys, which is case-insensitive on certain databases like SQLite . An attacker who can construct a case vari...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-103778

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-103778

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-103778

Dell Command | Configure (DCC) versions prior to 5.2.3.35 are susceptible to a Use of Hard-coded Cryptographic Key vulnerability (CWE-321). An unauthenticated attacker with local access could exploit this flaw to achieve Information disclosure . Remediation is available via the security update re...

EUVD-2026-93663

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193)

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management...

KsDumper-11

KsDumper-11 https://github.com/mastercodeon314/KsDumper-11/assets/78676320/9452970c-27cf-44df-b091-0d18a07937e5 v1.3.4の新機能 新しい機能「アンチ・アンチデバッグツール検出」を追加 実行中のMainWindowタイトル、ほとんどのコントロールタイトル、exeファイル名をランダム化 プログラム終了時にプロセス名はKsDumper11.exeに戻されます 「アンチ・アンチデバッグツール検出」を有効にするチェックボックス設定を追加...

CVE-2021-20323

CVE-2021-20323 説明 Keycloak 18.0.0 未満かつ 10.0.0 以降には、clients-registrations エンドポイントに反映型 XSS が存在します。このバグは、エンドポイントでサポートされていないパラメータ名をキーとする JSON 構造を POST で送信することでトリガーされます。レスポンスは、エラーメッセージ内に JSON キーを反映し、ヘッダーが Content-Type: text/html に設定されます。ブラウザで実行されると、JSON キー内の HTML コードが解釈され、JavaScript...

CVE-2025-99999

CVE-2025-99999 - HSM 펌웨어 인증 우회 설명 HSM 펌웨어 v4.5.0의 심각한 인증 우회로 키 추출이 가능합니다. 영향을 받는 시스템 HSM 펌웨어 v4.5.0 모든 빌드 이 HSM을 SWIFT 거래 서명에 사용하는 금융 기관 침해 지표 IOC IP| Port| 설명 ---|---|--- 127.0.0.1| 5001| HSM 익스플로잇을 위한 C2 서버 완화 조치 즉시 공급업체 패치를 적용하십시오. 참고 자료 https://your-cti-blog.com/advisory/CVE-2025-99999...

key-transparency-auditor

key-transparency-auditor Signal のキー透過性サービス向けのサードパーティ監査人の参照実装です。キー透過性 仕様に基づいています。 概要 このサービスは Java で書かれており、Micronaut フレームワークを使用しています。ビルドとユニットテストを行うには、ルートディレクトリで ./mvnw clean test を実行してください。 メインクラスは Auditor で、キー透過性サービスから更新のストリームを要求するスケジュールジョブを実行します。これは、キー透過性サービスの プレフィックスツリー と ログツリー...

rtx-cve-2023-45779

このリポジトリは、Meta Red Team X の脆弱性開示に付随するものですAS IS で提供されます。これは Meta の公式プロジェクトではなく、公式プロジェクトのようにサポートされることはありません。 AOSP のテストキーで署名された APEX を搭載する Android デバイスの検出と悪用を実証するスクリプトとアーティファクトのセットです。問題の詳細については、ブログ記事「Missing signs: how several brands forgot to secure a key piece of Android」を参照してください。 ファイル apex-checke...

ECC_Attacks

椭圆曲线密码学的已知攻击 介绍 椭圆曲线简介 密码学中的椭圆曲线 ECC 攻击 ECDH 攻击 生成元的阶太小 生成元的阶是光滑数 生成元的阶几乎是光滑数，且私钥很小 不验证点是否在曲线上 曲线是奇异曲线 曲线是超奇异曲线 曲线是异常曲线 ECDSA 攻击 签名前不对消息进行哈希 在不同签名中重用相同的 k 值 不安全地生成 k 值 不验证生成元是否有效 结论 ECDH 攻击概述 ECDSA 攻击概述 防御这些攻击 参考资料 介绍 近年来，椭圆曲线密码学方法因其高效性和强安全性而变得流行。本文旨在以比当前互联网上已有的资料更清晰的方式介绍这一主题。...

Payload vulnerable to API key disclosure through ordinary document reads

Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables useAPIKey. - Users have read access to other user documents...