CVE-2026-88830

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message. Mitigation Do not use the BusyBox sslserver applet in production environments. Use a well-maintained TLS implementation such...

CVE-2026-69219

A flaw was found in the RabbitMQ Java client library. A malicious AMQP Advanced Message Queuing Protocol peer can exploit this by sending a specially crafted message during the pre-authentication phase. This message can cause the client to allocate an excessively large amount of memory, leading t...

Exploit for Static Code Injection in N-Able N-Central

CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit Ove...

CVE-2026-88830: Incorrect Calculation of Buffer Size

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message...

Exploit for Code Injection in Langflow

IBM Langflow P...

jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 or :9990, or :4447 and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service...

artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBETOPOLOGYV2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore, no credential...

SUSE-SU-2026:23880-1 Security update for glib2

This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206...

PT-2026-104837

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre shared key extension in the ServerHello that the client never offered causes the client to complete the handshake without...

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential...

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the...

CVE-2026-59815 Joplin: Pending share recipients can write items into shared folders before accepting invitations

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...

SUSE CVE-2026-27780

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks...

Apache Kerby: org.apache.kerby/kerb-server: Apache Kerby: Kerberos pre-authentication bypass via unrecognized PA-DATA

A flaw was found in Apache Kerby. An attacker can bypass the Kerberos pre-authentication check by sending a Pre-Authentication Data PA-DATA packet with an unrecognized or unsupported type. This vulnerability allows an attacker to circumvent the initial authentication step, potentially leading to...

gpasskey

======== gpasskey .. image:: https://gitlab.com/renich/gpasskey/-/raw/master/assets/banner.svg :width: 100% :align: center :alt: gpasskey banner | .. image:: https://gitlab.com/renich/gpasskey/badges/master/pipeline.svg :target: https://gitlab.com/renich/gpasskey/-/commits/master :alt: pipeline...

VulnCheck KEV: CVE-2026-48842

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuserquery plugin via a pregreplace backslash escape bypass...

UBUNTU-CVE-2026-85495

pre-authentication global buffer overflow...

CVE-2026-85495

pre-authentication global buffer overflow...

Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam

CVE-2026-33439 Pre-auth RCE in OpenIdentityPlatform OpenAM vi...

boha v0.20.2

@agntn/puzzles Public crypto puzzles and bounties, as typed records. You ask for a puzzle, you get its address, its key material and what happened on chain. Why? Every puzzle thread has the same three things: the addresses, the prizes, and who solved what. Every scanner and tracker re-types them...