github.com/interplains/Zero-Breach-Toolkit
Submitted 10/31/2026, 1:11:13 AM · Status: ok
Risk grade
D
56 / 100
Findings
16
0 critical4 high12 medium0 low0 info0 on CISA KEV0ATT&CK
Showing 16 of 16 findings
Findings
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timinggrypeCVE-2026-69247EPSS 0.3%
- python-cryptography: Duplicate self-signed intermediates can cause exponential path-buildinggrypeCVE-2026-69249EPSS 0.3%
- The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(verify-release)checkov.github/workflows/verify-release.yml:13
- pytest has vulnerable tmpdir handlinggrypeCVE-2025-71176EPSS 0.2%
- python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtreesgrypeCVE-2026-69248EPSS 0.3%
- cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing### Summary `pkcs7_decrypt_der`, `pkcs7_decrypt_pem`, and `pkcs7_decrypt_smime` reported the outcome of decrypting a `RecipientInfo`'s `encryptedKey` in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction w…osv-scannerCVE-2026-69247
- cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing### Summary `pkcs7_decrypt_der`, `pkcs7_decrypt_pem`, and `pkcs7_decrypt_smime` reported the outcome of decrypting a `RecipientInfo`'s `encryptedKey` in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction w…osv-scannerCVE-2026-69247
- pytest has vulnerable tmpdir handlingpytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.osv-scannerCVE-2025-71176
- pytest has vulnerable tmpdir handlingpytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.osv-scannerCVE-2025-71176
- python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees### Summary If an intermediate constrained CA permits the DNS name `foo.example.com`, and the leaf certificate has a wildcard in its DNS SAN of `*.example.com`, python-cryptography's verifier accepts which allows escaping outside of the permitted names. ### PoC ``` #!/usr/bin/e…osv-scannerCVE-2026-69248
- python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees### Summary If an intermediate constrained CA permits the DNS name `foo.example.com`, and the leaf certificate has a wildcard in its DNS SAN of `*.example.com`, python-cryptography's verifier accepts which allows escaping outside of the permitted names. ### PoC ``` #!/usr/bin/e…osv-scannerCVE-2026-69248
- python-cryptography: Duplicate self-signed intermediates can cause exponential path-building### Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum…osv-scannerCVE-2026-69249
- python-cryptography: Duplicate self-signed intermediates can cause exponential path-building### Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum…osv-scannerCVE-2026-69249
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgreptools/release_fixture.py:144
This report is public.