GHSA-238X-W2J9-GWWR Payload vulnerable to API key disclosure through ordinary document reads

Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables useAPIKey. - Users have read access to other user documents...

NPM: Payload vulnerable to API key disclosure through ordinary document reads

NPM: Payload vulnerable to API key disclosure through ordinary document reads vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

Important: Red Hat Security Advisory: rust-sequoia-sqv security update

An update for rust-sequoia-sqv is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

poc-cribl-rce

إخلاء المسؤولية هذا للأغراض المعلوماتية/التعليمية فقط. تم تجميع هذا لإظهار نقطة ضعف في الأداة، وذلك للتحقق من الإصلاح من قبل البائع. معلومات تم الاختبار على Cribl الإصدار 1.5.0 - الإصدارات السابقة لم يتم اختبارها ولكنها على الأرجح معرضة للخطر. يمكن نقل رمز JWT صالح من وحقنه في جلسة مثيل Cribl آخر...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-105849

The Payload headless content management system is vulnerable to API key disclosure in versions 3.0.0 to 3.90.0 and canary versions before 4.0.0-canary.34 . If an authentication collection has useAPIKey enabled, users with ordinary read access to other authentication documents can obtain active AP...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-79551-Tenda

CVE-2026-79551 Clave privada TLS embebida en Tenda ID de CNVD: CNVD-2026-25884 Fabricante: Tenda Technology Co., Ltd. Producto: Grabador de video en red NVR4H versión de hardware CH3V2.1 Firmware: V27.5.58.6 Clase: CWE-321 — Uso de clave criptográfica embebida Descripción general El firmware del...

CVE-2026-46395-haxcms-hmac-key-leak

CVE-2026-46395 - HAXcms Node.js 因 HMAC 缺陷导致的私钥泄露 CWE-321 / CWE-200 仅限授权安全测试与研究的概念验证。 此处描述的漏洞已在 HAXcms 最新版本中修复 。 本 PoC 的发布是为了让防御者和研究人员能够在其拥有或明确授权测试的未打补丁实例上验证此问题。 | ---|--- CVE| CVE-2026-46395 组件| HAXcms Node.js 后端 - haxcms-nodejs/src/lib/HAXCMS.js 漏洞| 硬编码加密密钥 + 私钥泄露 CWE-321, CWE-200 严重性| 严重 - CVSS...

SafeGuard

./safeguard --version 1.0 Safeguard es una herramienta de línea de comandos rápida, ligera y multiplataforma para el cifrado de archivos, escrita en Go. Aviso de seguridad Este proyecto es una herramienta de cifrado de archivos con fines de aprendizaje. Aunque utiliza primitivas criptográficas...

CVE-2021-43798

CVE-2021-43798 Grafana 中的目录遍历和任意文件读取漏洞 作者： Wagner Alves - 红队分析师 该漏洞利用 Grafana 8.0 - 8.3 版本中的目录遍历和任意文件读取漏洞，能够读取诸如 /etc/passwd、/etc/hosts、/home/user/.ssh/idrsa、/etc/os-release 以及其他有趣的文件。 安装 git clone https://github.com/wagneralves/CVE-2021-43798.git cd CVE-2021-43798 chmod +x ExploitGrafana.sh 使用...

Important: Red Hat Security Advisory: rust-rpm-sequoia security update

An update for rust-rpm-sequoia is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

CVE-LiteLLM

cve-id ⚡ 简单使用 请仅在安全且授权的环境中使用此项目，例如： 本地虚拟机 Docker 容器 隔离的实验室环境 经过授权的渗透测试环境 示例设置： git clone cd 项目使用 Python，请按以下步骤操作 创建虚拟环境 python -m venv venv 激活虚拟环境 macOS / Linux source venv/bin/activate Windows Git Bash / WSL source venv/Scripts/activate 安装依赖 pip install -r requirements.txt 示例用法： 帮助 python...

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

Important: Red Hat Security Advisory: rust-rpm-sequoia security, bug fix, and enhancement update

An update for rust-rpm-sequoia is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 已在 VMware VCSA 6.7 上测试 创建 SSH 密钥对 ssh-keygen -t rsa -f vcsa.key -N '' 创建包含 ../../../../../home/vsphere-ui/.ssh/authorizedkeys 的 tarball python2 evilarc.py -d 5 -p 'home/vsphere-ui/.ssh' -o unix -f evil.tar authorizedkeys mv evil.tar evil.ova 将 evil.ova 上传到...

CVE-2025-45809-PoC

CVE-2025-45809 — LiteLLM SQL Injection via /key/block Time-Based Blind SQLi LiteLLM v1.65.4（v1.81.0 之前版本）的 /key/block 和 /key/unblock 端点 中的 key 参数存在 SQL 注入漏洞 。攻击者可利用基于时间的盲注技术 窃取数据库内容、读取服务器文件。 Field| Value ---|--- CVE| CVE-2025-45809 GHSA| GHSA-cgmh-xxmq-hp46 CVSS v3.1| 5.4 MEDIUM —...