CVE-2026-59644

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

DEBIAN-CVE-2026-59643

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

CVE-2026-18582 mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heap

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function ReportingRCBWriteAccessHandler of the file src/iec61850/server/mmsmapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not ...

CVE-2026-59642 CMS AuthenticatedData content not bound to MAC when authAttrs present

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X seri...

EUVD-2026-52030

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644

CVE-2026-59644 affects Bouncy Castle for Java up to version 1.84, where the MLS hash-ratchet may honor an arbitrary 32-bit generation counter from the sender. This can impact availability (per CVSS: HIGH) with no confidentiality or integrity impact reported, and no exploitation details are provid...

CVE-2026-59651 BKS keystore accepts legacy version with 16-bit integrity MAC key

In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

The vulnerability of the quote() function in the shell-quote npm package, which allows a hacker to execute arbitrary code.

The vulnerability of the quote function in the shell-quote npm package is related to the lack of data cleansing measures at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2026-38447

Summary: CVE-2026-38447 affects osTicket 1.18.3, where API keys are generated with a predictable construction based on MD5 hashing and inputs such as the current timestamp and client IP. The underlying issue is low-entropy key generation due to MD5 and predictable inputs. Impact: The vulnerabilit...

frr10 security, bug fix, and enhancement update

10.4.3-3.2 - Resolves: RHEL-222338 - AVC when reading user's site-packages 10.4.3-3.1 - Fix CVE-2026-37460: improve packet parsing for EVPN and ENCAP/VNC - Resolves: RHEL-193232...

CVE-2026-67972

An issue in the CFCFDPRecvMd component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure...

CVE-2026-10848

creationtimestamp| type| source ---|---|--- 2026-08-02 18:50:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4nlsi2o42p 2026-08-02 19:07:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4olaqzdj2e...

CVE-2019-11683

creationtimestamp| type| source ---|---|--- 2026-08-02 17:00:05+00:00| seen| https://t.me/nuancesprognews/168 2026-08-03 01:51:30+00:00| seen| https://t.me/nuancesprognews/168...

CVE-2026-18280

creationtimestamp| type| source ---|---|--- 2026-08-02 15:30:52+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117026629340357922...

CVE-2026-68581

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-68581

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2025-71400 better-auth passkey before 1.4.0 IDOR via delete-passkey

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

CVE-2026-67297

creationtimestamp| type| source ---|---|--- 2026-08-02 12:06:49+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117025826980637484 2026-08-02 12:06:49+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3ms3x2te2p32j...

CVE-2026-15241

creationtimestamp| type| source ---|---|--- 2026-08-02 11:54:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3wee2wlp2d 2026-08-02 11:54:16+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms3wefzg7b25...