CVE-2026-102412

Kibana versions 9.3.0 through 9.3.8 , 9.4.0 through 9.4.7 , and 9.5.0 through 9.5.4 are vulnerable to Incorrect Authorization (CWE-863) . An authenticated user with limited Fleet management privileges can bypass Access Control Lists (ACLs) to access sensitive credential material restricted to Fle...

CVE-2026-103778

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

EUVD-2026-93663

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-103778

Dell Command | Configure (DCC) versions prior to 5.2.3.35 are susceptible to a Use of Hard-coded Cryptographic Key vulnerability (CWE-321). An unauthenticated attacker with local access could exploit this flaw to achieve Information disclosure . Remediation is available via the security update re...

CVE-2026-103778

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193)

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management...

Kibana 9.x / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 Incorrect Authorization (ESA-2026-193)

The version of Kibana installed on the remote host is 9.3.x, or 9.4.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-193 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via...

CVE-2026-85153: Use of Hard-coded Cryptographic Key

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials an...

CVE-2026-103778: Use of Hard-coded Cryptographic Key

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

PT-2026-107112

Name of the Vulnerable Software and Affected Versions Dell Command | Configure DCC versions prior to 5.2.3.35 Description An issue exists due to the use of a hard-coded cryptographic key. An unauthenticated attacker with local access could exploit this to cause information disclosure...

CVE-2026-102412: Incorrect Authorization

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

GHSA-JXW3-MJMX-3PQM Langflow: Weak Fernet Key via random.seed()

Summary Langflow uses Python's random module Mersenne Twister, a non-cryptographic PRNG seeded with the SECRETKEY to derive the Fernet encryption key for all stored user credentials API keys, LLM provider secrets, database passwords. When the SECRETKEY is shorter than 32 characters — a common...

CVE-2026-105392

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392 Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

Astra Linux – Vulnerability in NTP

In NTP versions 4.2.8, 4.2.8p15, and 4.3.x, before 4.3.101, remote attackers could cause a denial of service memory consumption by sending packets. This occurs because memory is not released in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file...

CVE-2026-105392: Use of Hard-coded Cryptographic Key

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

PT-2026-106204

Name of the Vulnerable Software and Affected Versions Lybbn Django-Vue-Lyadmin versions prior to 3.2.13 Description An issue exists in the JWT Signing component within the file backend/application/settings.py. The manipulation of the SECRET KEY argument allows the use of a hard-coded cryptographi...

CVE-2026-94591 Armatura LLC Armatura One Use of Hard-coded Cryptographic Key

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation...

EUVD-2026-91069

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-94591: Use of Hard-coded Cryptographic Key

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation...