PT-2026-77579

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 Description A flaw in the Installation and Configuration component allows a low privileged attacker with access to the infrastructure where the software executes to compromise the...

CVE-2026-71417: Authorization Bypass Through User-Controlled Key

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

CVE-2026-43971: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cowlink:link/1. cowlink:dolink/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header valu...

CVE-2026-71307: Missing Authorization

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting...

ANT-2026-ZYEZKB5Y · OpenSC · Stack Buffer Overflow

stack-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-ZYEZKB5Y: Stack buffer overflow in...

ANT-2026-MHV0A2SD · FreeType2 · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-MHV0A2SD: Heap buffer overflow in Type 1...

ANT-2026-V6YZYDKK · FreeType2 · Stack Buffer Overflow

stack-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-V6YZYDKK: Stack buffer overflow via pop aft...

Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution bsc1272393. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2026:3631-1 Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: - CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution bsc1272393...

EUVD-2026-60107

opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...

openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.

A flaw was found in OpenSSL. An integer truncation vulnerability in the ASN.1 decoder can occur when processing a crafted DER-encoded ASN.1 structure with a primitive element exceeding 2 gigabytes. A remote attacker could exploit this to cause a heap buffer over-read. This may lead to an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: samba (UTSA-2026-100778)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100778 advisory. An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded...

CVE-2025-10005: Authorization Bypass Through User-Controlled Key

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...

AZL-96246 CVE-2026-74509 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix advertising data UAFs hcifindadvinstance returns an advinfo pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some...

CVE-2026-19891

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

EUVD-2026-59607

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

CVE-2026-19891 TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryption

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

CVE-2026-72279

The CVE-2026-72279 entry concerns the Linux kernel KVM arm64 implementation for the L1 VNCR mapping. The fix ensures that the host stage-1 mapping respects the read-only status of the guest PFN by caching PFN writability in the VNCR TLB and using this to constrain fixmap permissions. If a guest t...

CVE-2026-19891: Missing Encryption of Sensitive Data

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

PT-2026-72886

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-WLC100 version 2.05b02 Description An issue exists in the IKE Phase 1 Aggressive Mode component within the /etc/racoon.conf file. Manipulation of the exchange mode argument leads to a failure in encrypting sensitive data. This fla...