Vulnerability · Published Mar 12, 2026 · Assigned by GitHub_M

CVE-2026-32138NEXULEAN API Key Leak

High 8.2

In plain English

A high-severity improper access control in website from Stalin-143. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 81.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester. Prior to 2.0.0, a security vulnerability was identified where Firebase and Web3Forms API keys were exposed. An attacker could use these keys to interact with backend services without authentication, potentially leading to unauthorized access to application resources and user data. This vulnerability is fixed in 2.0.0.

Affected products (as reported)

Vendor	Product	Versions
Stalin-143	website	< 2.0.0

Weakness: CWE-284, CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/Stalin-143/website/security/advisories/GHSA-r7cr-5wcx-x9wm x_refsource_CONFIRM
https://github.com/Stalin-143/website/releases/tag/v2.0.0 x_refsource_MISC