Checkmarx-CVE-2025-30066-Detection-Tool

Checkmarx-CVE-2025-30066-Detection-Tool These are tools for scanning your GitHub workflows and logs for potential malicious actions associated with CVE-2025-30066. It checks for a set of known risky GitHub Actions and a suspicious code snippet embedded in workflow files. As well for secrets that...

BucketLoot

BucketLoot An Automated S3-compatible Bucket Inspector Description • Installation • Features • Documentation • Acknowledgements Description BucketLoot is an automated S3-compatible Bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as we...

MongoDeepDive

🌊 MongoDeepDive 컨텍스트 인식 MongoDB 와이어 프로토콜 익스플로잇 CVE-2025-14847 레드팀 운영을 위한 고급 휴리스틱 분석기 💀 개요 MongoDeepDive 는 CVE-2025-14847 의 영향을 받는 MongoDB 서버에서 초기화되지 않은 메모리 누수 를 탐지하도록 설계된 고성능 비동기 취약점 스캐너 및 포렌식 분석기입니다. 단순히 응답 크기만 확인하는 표준 PoC 스크립트와 달리, MongoDeepDive는 섀넌 엔트로피 분석과 휴리스틱 필터링을 사용하여 빈 메모리 패딩가비지과 고가치 비밀예:...

CVE-2024-9014

이 게시물은 EQSTLab에서 발행한 연구 기사입니다. CVE-2024-9014 ★ CVE-2024-9014 민감 정보 노출 PoC ★ 설명 CVE-2024-9014 : pgAdmin4 민감 정보 노출 설명: pgAdmin 8.11 및 이전 버전은 OAuth2 인증에 보안 결함이 있습니다. 이 취약점으로 인해 공격자가 클라이언트 ID와 시크릿을 획득하여 사용자 데이터에 무단 액세스할 수 있습니다. PoC 명령어 curl URLTOTEST/login?next=/ | grep -o '"oauth2Config": .' | sed...

OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

CVE-2025-68664

CVE-2025-68664 All I Want for Christmas Is Your Secrets: LangGrinch Strikes LangChain Core CVE-2025-68664 Author: Yarden Porat Cyata Research: LangGrinch Vulnerability in LangChain Published: https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ Yesterday LangChain published a critical...

CVE-2025-4679-SecureOAuth-Demo---Enfoque-educativo

🔐 OAuth Security Laboratory: CVE-2025-4679 Educational Simulator A safe, isolated environment to learn about OAuth vulnerabilities without risking real systems 🚀 Quick Start | 📚 Learning Path | 🛡️ Safe Environment | 👥 Contributors 📖 Overview This educational laboratory simulates the CVE-2025-4679...

langgrinch-cve-2025-68664-analysis

LangGrinch 취약점 분석: CVE-2025-68664 개요 이 저장소는 LangChain Core에 영향을 미치는 직렬화 주입 취약점인 LangGrinch라고도 알려진 CVE-2025-68664를 분석한 기술 보고서를 포함합니다. 이 보고서는 취약점 배경, 근본 원인, 악용 흐름, 위협 모델, 완화 전략, 그리고 LLM 기반 애플리케이션에 대한 실제 보안 영향을 설명합니다. 다루는 주제 LangChain 직렬화 및 역직렬화 안전하지 않은 역직렬화 / CWE-502 LLM 애플리케이션 보안 전달 경로로서의 프롬프트 인젝션...

POC_CVE-2026-42880

CVE-2026-42880 — ArgoCD ServerSideDiff를 통한 Secret 노출 Argo CD에서 ServerSideDiff gRPC 핸들러가 읽기 전용 사용자에게 Kubernetes Secret 데이터를 노출하는 치명적인 취약점인 CVE-2026-42880 을 재현하고 탐지하기 위한 실습 환경입니다. 취약점 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2026-42880 GHSA| GHSA-3v3m-wc6v-x4x3 CVSS| 9.6 치명적 —...

boatcrash

boatcrash Exploit for CVE-2019-19030 that affects Harbor versions Use this script on Harbor instances running versions under 1.10.3 or 2.0.1 to enumerate all projects present in the platform. It can also be used to enumerate projects on higher versions but you will only be able to enumerate publi...

Security update for nodejs16

This update for nodejs16 fixes the following issues: CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification bsc1236250. CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218. CVE-2025-23167: llhttp:...

SUSE-SU-2026:4355-1 Security update for nodejs16

This update for nodejs16 fixes the following issues: - CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification bsc1236250. - CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218. - CVE-2025-23167:...

EUVD-2026-87238

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecre...

CVE-2026-67410 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecre...

CVE-2026-67410

RabbitMQ, a messaging and streaming broker, is vulnerable to an OAuth2 Client Secret exposure (CWE-200) in versions 4.2.0 until 4.3.3 and 4.2.9 . When OAuth2 authentication is enabled for the Management UI using a flow that requires a client secret, the oauthclientsecret configuration value is in...

CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

microsandbox: Secret values exposed in world-readable process arguments

Summary When the SDK spawns a sandbox, the msb sandbox child process receives the full network configuration as an inline --network-config command-line argument, and any per-sandbox environment as repeated --env KEY=VALUE arguments. On Linux a process's arguments are world-readable via...

SUSE SLES15 Security Update : nodejs18 (SUSE-SU-2026:4261-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4261-1 advisory. - CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request bsc1236258...

CVE-2026-61670 microsandbox: Secret values exposed in world-readable process arguments

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandboxcmd.rs...