Lucene search
+L

46459 matches found

OSV
OSV
added 2026/08/17 11:04 a.m.4 views

CVE-2026-74892 openssl_encrypt before 1.4.0 Hardcoded Secret Key

opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

8.7CVSS5.5AI score
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/17 11:04 a.m.13 views

CVE-2026-74893

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

8.8CVSS5.3AI score0.00264EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/08/17 11:04 a.m.9 views

CVE-2026-74892

opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

8.7CVSS5.4AI score0.00306EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/17 11:04 a.m.18 views

CVE-2026-74893

openssl_encrypt (PyPI package) versions before 1.4.0 hardcode default JWT signing secrets in config.py that bypass validation checks. Anyone with source-code access can forge valid JWT tokens for any client_id, gaining authenticated access to keyserver and telemetry APIs. CVSS 3.1 score is 8.8 (H...

8.8CVSS5.3AI score0.00264EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/17 11:04 a.m.37 views

CVE-2026-74892 openssl_encrypt before 1.4.0 Hardcoded Secret Key

opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

8.7CVSS0.00306EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/17 11:04 a.m.48 views

CVE-2026-74890 openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

9.3CVSS0.00165EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/17 11:04 a.m.7 views

EUVD-2026-60109

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

9.3CVSS6AI score0.00165EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/17 11:04 a.m.5 views

CVE-2026-74890 openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

9.3CVSS6.2AI score
SaveExploits0References4
CVE
CVE
added 2026/08/17 11:04 a.m.25 views

CVE-2026-74890

openssl_encrypt versions before 1.4.0 have an authentication bypass in the CamelliaCipher component: setting the PYTEST_CURRENT_TEST environment variable disables HMAC tag generation and verification, allowing attackers with code execution to produce unauthenticated ciphertext and bypass integrit...

9.3CVSS6AI score0.00165EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/17 11:04 a.m.4 views

CVE-2026-74878 openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

9.3CVSS5.4AI score
SaveExploits0References4
CVE
CVE
added 2026/08/17 11:04 a.m.24 views

CVE-2026-74878

openssl_encrypt versions before 1.4.0 contain a TOTP brute-force rate limiter bypass in openssl_encrypt_server/modules/pepper/totp.py. The TOTPRateLimiter class stores attempt and lockout state in an in-memory defaultdict(list) as a class variable, meaning rate-limit state is not shared across wo...

9.8CVSS5.3AI score0.00372EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/17 11:04 a.m.18 views

CVE-2026-74867

SiYuan versions before 3.7.4 are affected by a cross-site request forgery (CSRF) vulnerability in the session-cookie authentication branch of CheckAuth() . The root cause is the absence of Origin/Referer header validation combined with the lack of an explicit SameSite attribute on session cookies...

4.2CVSS5.1AI score0.00103EPSS
SaveExploits0References2
Malwarebytes
Malwarebytes
added 2026/08/17 10:56 a.m.13 views

Update your Mac: Screen Sharing vulnerability exploited in the wild

The Dutch National Cyber Security Centre NCSC issued a warning after being notified of several incidents where a vulnerability in Apple’s Screen Sharing feature was exploited to install Monero cryptominers. The vulnerability, tracked as CVE-2026-65400, was patched by Apple on August 6. It is an...

9.8CVSS6.2AI score0.00751EPSS
SaveExploits2
Veracode
Veracode
added 2026/08/17 9:05 a.m.7 views

Authentication Bypass

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...

4.8CVSS5.1AI score0.00371EPSS
SaveExploits0References4Affected Software1
Patchstack
Patchstack
added 2026/08/17 8:21 a.m.12 views

WordPress User Profile Builder plugin <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability

Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Profile Builder versions = 3.16.4...

9.8CVSS5.3AI score0.02483EPSS
SaveExploits1References1Affected Software1
OSV
OSV
added 2026/08/17 7:32 a.m.5 views

MINI-6GC4-C72W-VFQX

Bulletin has no description...

7.5CVSS5AI score0.00465EPSS
SaveExploits0
OSV
OSV
added 2026/08/17 7:32 a.m.4 views

MINI-5XRG-PFX6-3QQQ

Bulletin has no description...

6.1CVSS4.9AI score0.00263EPSS
SaveExploits0
OSV
OSV
added 2026/08/17 7:32 a.m.4 views

MINI-XH34-53RP-9J9Q

Bulletin has no description...

9.6CVSS5AI score0.00655EPSS
SaveExploits0
OSV
OSV
added 2026/08/17 7:32 a.m.4 views

MINI-PQV5-5XMH-V4WM

Bulletin has no description...

7.5CVSS5AI score0.0035EPSS
SaveExploits0
OSV
OSV
added 2026/08/17 7:32 a.m.3 views

MINI-JJ8J-CJVX-446F

Bulletin has no description...

7.5CVSS4.9AI score0.00483EPSS
SaveExploits0
Rows per page
Query Builder