CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

EUVD-2026-81358

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

keyguard

keyguard Escanea bases de código, proyectos de GCP y pipelines de CI en busca de credenciales expuestas de la API de Google, antes de que sean explotadas. El problema: Google habilitó retroactivamente el acceso a la API de Gemini en claves API existentes Maps, Places, etc. que fueron diseñadas pa...

GitLeaks

GitLeaks GitLab CI 组件 一个用于 Gitleaks 的 GitLab CI 组件 —— 一款用于检测和防止硬编码秘密（如密码、API 密钥和令牌）被提交到 git 仓库的 SAST 工具。 功能特性 秘密检测 ：扫描仓库中的硬编码秘密和敏感信息 全面规则集 ：包含大量内置规则，用于检测各类秘密 自定义配置 ：支持本地和远程配置文件 多种输出格式 ：支持 JSON、SARIF 及其他报告格式 灵活参数 ：可直接向 Gitleaks 传递附加标志 远程配置 ：从远程 URL 下载并使用配置文件 可配置作业设置 ：可自定义作业名称、阶段和容器镜像 使用方法 基本用法...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-34102...

CVE-2026-41940

Basado en Watch Tower POC , Soporta acceso directo a shell vía websocket , y añadir claves raíz de API para persistencia...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite 检查点 SQL 注入 CVE-2025-67644 是 langgraph-checkpoint-sqlite 包（属于 LangGraph / LangChain 生态）中的一个 SQL 注入 漏洞（CWE-89）。 攻击者可通过传递给 SqliteSaver 的 list / 方法的未经净化的注入任意 SQL。...

actions-secrets

Acción de GitHub para el Análisis de Secretos de SecureStack Una Acción de GitHub que analiza tu código fuente en busca de secretos, credenciales, claves de API, nombres de host/URLs de servidores y bases de datos, ¡y mucho más! Cuando la agregas a GitHub Actions, analizamos tu código fuente para...

CVE-2026-92570 reNgine through 2.2.0 Unauthorized Configuration File Read

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like...

voron-crypto

Voron 加密/协议库 — 评审请求 这是一个小型 E2EE 即时通讯项目的加密与消息协议核心，被单独提取出来供外部评审。它不是 完整产品——Android 客户端和部署配置被有意排除在外；这只是需要接受审查的部分。 这里包含什么 common/ — 库本身： e2ee/ — X3DH-lite（异步密钥协商）+ 其上的 Double Ratchet，基于 Curve25519/ChaCha20-Poly1305/Ed25519/HKDF 构建（JDK 提供的原语，该层没有任何手写实现）。 crypto/ — 对这些 JDK 原语的薄封装。 group/ — 通过 sender-key...

synodecrypt

SynoDecrypt A tool to decrypt all Synology encrypted archives SPK, PAT, .... The reverse engineering work is explained in our blog post. Installation root@kitploit: pip install -r requirements.txt Usage You first have to extract the encryption keys and put them into a JSON file e.g. into keys.jso...

CVE-2026-92456

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController , allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy stored in shared Redis keys. An attac...

CVE-2026-92456 yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints ...

CVE-2026-14483_exploit

CVE-2026-14483 — Realtyna WPL / Organic IDX: subida arbitraria de archivos sin autenticación → RCE Subida arbitraria de archivos sin autenticación que conduce a RCE en el plugin de WordPress Realtyna WPL / Organic IDX real-estate-listing-realtyna-wpl ≤ 5.2.0. El plugin registra un «servicio de E/...

CVE-2026-27557 Path Traversal in /index.php/view_uploaded_iodd_file

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/viewuploadedioddfile endpoint allowing the SSH server's private keys to be read...

CVE-2026-27557

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint to read the SSH server's private keys , resulting in high confidentiality impact with no integrity or availability impact (CVSS 3.1: 7.5 HIGH ). The specific affected p...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320: Almacenamiento en texto claro de información sensible en memoria en Abacre Restaurant Point of Sale POS. Todas las versiones de Abacre Restaurant Point of Sale POS hasta la 15.0.0.1656 son vulnerables al almacenamiento en texto claro de información sensible en...

Dark_Ledger

Dark Ledger Este repositorio sirve como un archivo de información sobre mercados de la darknet, incluyendo: Listas de vendedores Claves PGP de vendedores Publicaciones y descripciones Estructura del mercado y otros datos relevantes CDN Si buscas descargar "The Darknet Market Archives" de Gwern.ne...

EUVD-2026-80067

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed...

CVE-2026-15638

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed...