Skip to content
Threat Feed
Subscribe

Tag

Key-Disclosure

2 briefs RSS
critical advisory

HAXcms Node.js Backend Private Key Disclosure via Broken HMAC Implementation

The HAXcms Node.js backend contains two cryptographic implementation errors in the `hmacBase64()` function that allow an unauthenticated attacker to extract the system’s private signing key and forge arbitrary admin-level JSON Web Tokens (JWTs) allowing them to get full admin access with a single HTTP request.

@haxtheweb/haxcms-nodejs cve-2026-46395 haxcms key-disclosure jwt privilege-escalation
2r 1t
high advisory

Cilium `cilium-bugtool` WireGuard Private Key Exposure

The `cilium-bugtool` debugging tool in Cilium exposes WireGuard private keys, potentially allowing unauthorized access to encrypted node-to-node communication in affected versions.

Cilium wireguard key-disclosure credential-access
2r 1t 1i