6347 matches found
EUVD-2026-80093
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator...
CVE-2026-86109
Arista VeloCloud Edge (formerly VeloCloud Edge by Broadcom) contains a vulnerability in its software update workflow that may accept update bundles without properly validating their signatures. The root cause is that the workflow does not restrict the digest algorithm used for artifact verificati...
PT-2026-93263
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator...
CVE-2025-36591: Use of a Broken or Risky Cryptographic Algorithm
Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographic Algorithm vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure...
CVE-2026-82190: Use of Predictable Algorithm in Random Number Generator
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...
Astra Linux - Vulnerability in Golang-1.19
Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/TLS clients, as well as servers that have Config.ClientAuth set to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default...
Astra Linux – Vulnerability in OpenSSH
OpenSSH versions prior to 10.3 can use unintended ECDSA algorithms. Any listing of ECDSA algorithms in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted as meaning all ECDSA algorithms...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ima: Fixed a potential memory leak in imainitcrypto. If the SHA1 template is unable to be allocated, IMA fails to initialize and exits without freeing the imaalgoarray. Adding the necessary kfree call for imaalgoarray will preven...
Astra Linux – Vulnerability in Linux
In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, only the init netns should be allowed to set the default tcpcongestioncontrol to a restricted algorithm. The tcpsetdefaultcongestioncontrol function is netns-safe as it writes to...
Astra Linux – Vulnerability in libssh
A NULL pointer dereference was detected in libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service...
Astra Linux – Vulnerability in Linux 5.10, Linux
Before version 5.17.9, the Linux kernel allowed TCP servers to identify clients by observing which source ports were used. This occurs due to the use of Algorithm 4 "Double-Hash Port Selection Algorithm" from RFC 6056...
Astra Linux – Vulnerability in OpenSSH
In OpenSSH versions 5.7 through 8.4, there is an observable discrepancy that can lead to an information leak during algorithm negotiations. This vulnerability allows man-in-the-middle attackers to target initial connection attempts, where no host key has been cached by the client. NOTE: Some...
CVE-2026-90779
SIPp through version 3.7.7 is affected by a stack buffer overflow in the createAuthHeader() function. The vulnerability is triggered when processing SIP authentication challenges (HTTP 401 or 407) containing oversized algorithm parameters , allowing a malicious SIP server to corrupt the stack and...
CVE-2026-90779 SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter
SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process...
PT-2026-90850
SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process...
CVE-2026-3869
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC...
CVE-2026-3869
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC...
CVE-2026-3869
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC...
EUVD-2026-76132
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC...
CVE-2026-3869
CVE-2026-3869 is a Critical (CVSS 4.0: 9.2) vulnerability in the Schneider Electric Modicon M580 programmable logic controller (PLC). The flaw is a CWE-303 (Incorrect Implementation of Authentication Algorithm) that can lead to loss of confidentiality, integrity, and availability of the PLC when ...