CVE-2026-79960

The Gitea repository management platform contains a vulnerability where pushes authenticated with a deploy key are incorrectly recorded as being performed by the repository owner. This Incorrect Authorization (CWE-863) causes permission checks in the push hook pipeline to evaluate the owner's pri...

EUVD-2026-93918

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-79960 Gitea deploy key pushes acting as the repository owner

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-79960 Gitea deploy key pushes acting as the repository owner

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-79960 Gitea deploy key pushes acting as the repository owner

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-103059

A flaw in Gitea allows an authentication bypass when the built-in SSH server is enabled (START_SSH_SERVER = true). The root cause is the use of an SQL LIKE comparison for looking up public keys, which is case-insensitive on certain databases like SQLite . An attacker who can construct a case vari...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-103778

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

EUVD-2026-93663

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-103778

Dell Command | Configure (DCC) versions prior to 5.2.3.35 are susceptible to a Use of Hard-coded Cryptographic Key vulnerability (CWE-321). An unauthenticated attacker with local access could exploit this flaw to achieve Information disclosure . Remediation is available via the security update re...

CVE-2026-103778

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193)

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management...

KsDumper-11

KsDumper-11 https://github.com/mastercodeon314/KsDumper-11/assets/78676320/9452970c-27cf-44df-b091-0d18a07937e5 Novedades en v1.3.4 Nueva función añadida: Detección Anti Anti-Debugging Tools Título de la ventana principal aleatorizado, la mayoría de los títulos de controles y el nombre del archiv...

CVE-2021-20323

CVE-2021-20323 描述 Keycloak 18.0.0 之前和 10.0.0 之后的版本在 clients-registrations 端点存在反射型 XSS 漏洞。该漏洞通过 POST 提交一个 JSON 结构触发，该结构的键是端点不支持的参数名。响应会在错误信息中回显该 JSON 键，并将头部设置为 Content-Type: text/html。在浏览器中执行时，JSON 键中的 HTML 代码会被解析，从而触发 JavaScript 代码。无需认证，漏洞影响所有可用的 realm。 当前，由于该漏洞需要 Content-Type: application/json 并...

CVE-2025-99999

CVE-2025-99999 - HSM 固件认证绕过 描述 HSM 固件 v4.5.0 中存在严重认证绕过漏洞，可导致密钥提取。 受影响系统 HSM 固件 v4.5.0（所有版本） 使用该 HSM 进行 SWIFT 交易签名的金融机构 入侵指标（IOC） IP| 端口| 描述 ---|---|--- 127.0.0.1| 5001| 用于 HSM 漏洞利用的 C2 服务器 缓解措施 立即应用供应商补丁。 参考 https://your-cti-blog.com/advisory/CVE-2025-99999...

key-transparency-auditor

key-transparency-auditor Una implementación de referencia de un auditor de terceros para el servicio de transparencia de claves de Signal, basada en la especificación de transparencia de claves. Descripción general Este servicio está escrito en Java utilizando el framework Micronaut. Para compila...

rtx-cve-2023-45779

Este repositorio se proporciona TAL CUAL para acompañaruna divulgación de vulnerabilidad de Meta Red Team X. No es un proyecto oficial de Meta y no recibirá soporte como tal. Un conjunto de scripts y artefactos que demuestran la detección y explotación de dispositivos Android que incluyen APEXes...

ECC_Attacks

Ataques conocidos a la criptografía de curvas elípticas Introducción Introducción a las curvas elípticas Curvas elípticas en el contexto de la criptografía Ataques ECC Ataques ECDH El orden del generador es demasiado pequeño El orden del generador es un número liso El orden del generador es casi ...

Payload vulnerable to API key disclosure through ordinary document reads

Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables useAPIKey. - Users have read access to other user documents...