37936 matches found
swaggerHole
A python3 script searching for secret on swaggerhub Introduction • Requirements • Installation • Usage • Output explanation • Thanks Created by Liodeus Introduction This tool is made to automate the process of retrieving secrets in the public APIs on swaggerHub. This tool is multithreaded and pip...
CVE-2026-86332
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...
CVE-2026-86332
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...
CVE-2026-86332
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...
trivy-action
Trivy Action GitHub Action for Trivy Table of Contents Usage Scan CI Pipeline Scan CI Pipeline w/ Trivy Config Cache Trivy Setup Scanning a Tarball Using Trivy with templates Using Trivy with GitHub Code Scanning...
Kubernetes Dashboard <1.10.1 - Authentication Bypass
Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...
Pre-Auth Takeover of Build Pipelines in GoCD
GoCD contains a critical information disclosure vulnerability whose exploitation allows unauthenticated attackers to leak configuration information including build secrets and encryption keys. id: CVE-2021-43287 info: name: Pre-Auth Takeover of Build Pipelines in GoCD author: dhiyaneshDk severity...
Windmill < 1.603.3 - SQL Injection
Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...
Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation
A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...
deepsecrets
DeepSecrets - シークレットスキャンのためのより良いツール !WARNING アクティブな開発は作成者のフォーク（https://github.com/ntoskernel/deepsecrets）に移行しました。このリポジトリは今後更新されません。...
dismember
🔪 Dismember Dismemberは、Linux用のコマンドラインツールキットで、すべてのプロセス（または特定のプロセス）のメモリをスキャンして、一般的な秘密情報やカスタム正規表現などを検出するために使用できます。 最終的には完全な /proc ツールキットになる予定です。 grep コマンドを使用すると、すべての（アクセス可能な）プロセスの全メモリに対して正規表現のマッチングを行うことができます。これは、メモリ内の機密データを見つけたり、メモリに含まれる情報からプロセスを特定したり、プロセスのメモリを調査して興味深い情報を得るために使用できます。 scan...
MAL-2026-16038 Malicious code in scw-mobile (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f92fe2c0fe1acd783b5612c30ba1976c68c421b6451a68d150928e5166c362e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16041 Malicious code in wallet-engine-signing (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 448194cce4cee2143b4cfee29a7c171ecab686469ac508f8fb2ad4d2fb67cf67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
vibe-coding-security
Vibe Coding 安全 在你发推宣布上线之前，请先运行这 69 项检查。它们对应的是 Lovable RLS CVE（CVE-2025-48757，170+ 个应用，2025 年）、Moltbook 泄露（150 万个 API 令牌，2026 年 2 月）以及 2026 年 4 月 Lovable 平台入侵事件（其他用户项目的源代码+服务密钥，暴露约 2.5 个月）背后的确切模式。 想要完整工具包？ 50 个审计技能、15 个 .cursorrules、1 个 MCP 配置 + 4 个 CLI 配方、30 个对抗性审查提示词、10 个案例研究。5 分钟安装。固定 $10。 →...
Metasploit-Module-TFM
Custom Metasploit Module for CVE 2023-2728 and CVE 2024-3177 Description This custom module exploits CVE 2023-2728 and CVE 2024-3177 in Kubernetes versions that are vulnerables to each of them e.g. v1.27.2 is vulnerable to both, both related to bypassing the imposition of the mountable secrets...
gha-lab-b16a4f3554
自动化研究产物 — 非上游项目。 本仓库是由自动化工具链构建的一次性实验环境，用于拉瓦尔大学硕士论文中复现已发表的 GitHub Actions 工作流漏洞。它是 qgis/QGIS 在提交 48ffad0d4b0f533982d7a4e46d3e75410da46ccb（2026-01-23）时的逐字快照，依据该项目自身的许可证重新分发，该许可证文件已原样包含在本快照中。 上游项目未 参与其中，也从未 成为攻击目标，此处研究的漏洞已公开。本仓库中的每个密钥和变量均为随机生成的虚拟值——不存在任何真实凭据。操作引用和运行器镜像已固定到它们在 2026-01-23...
EUVD-2026-58516
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation...
gha-lab-3b0a828a69
自动化研究产物 — 非上游项目。 本仓库是由自动化工具链为拉瓦尔大学（Université Laval）硕士论文构建的一次性实验环境，用于复现已发表的 GitHub Actions 工作流漏洞。它是 gluestack/gluestack-ui 在提交 46641d268259805ddf1f8f785051df756cdbd62a（2025-04-14）时的逐字快照，依据该项目自身的许可证重新分发，该许可证文件已原样包含在本快照中。 上游项目未 参与其中，也从未...
jsluicepp
📄 目录 👋 简介 🛠️ 设置 📝 用法 📜 功能特性 监控 URL 发送到 Repeater 机密 机密通知 复制 URL 包含/排除匹配 仅限作用域内 内联标签 隐藏重复项 显示带参数的行 导入/导出 保存设置 👋 简介 jsluice++ 是一款 Burp Suite 扩展，旨在使用 CLI 工具 jsluice 对 JavaScript 流量进行被动和主动扫描。 该扩展利用 jsluice 的能力从静态 JavaScript 文件中提取 URL、路径和机密信息，并将其与 Burp Suite 集成，使您能够轻松扫描来自 Burp Suite Sitemap 或 Proxy 的...