Important: dotnet9.0

Issue Overview: Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47303 Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-51977: Use of Hard-coded Cryptographic Key

An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component...

Apache Tomcat Cryptographic Algorithm

The vulnerability of the Apache Tomcat application server is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability allows a remote attacker to alter the encryption preferences...

CVE-2026-18500: Improper Verification of Cryptographic Signature

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify key is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different...

Linux Distros Unpatched Vulnerability : CVE-2026-74438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: sun4i-ss - Remove insecure and unused rngalg Remove sun4issrng, as it is insecure and unused: - It has multiple vulnerabilities. sun4issprngseed is...

CVE-2026-27871

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63...

CVE-2026-64887 Airwall - Hardcoded Secrets

Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1...

CVE-2026-27871 TL280

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63...

CVE-2026-27871

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63...

CVE-2026-27871 TL280

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63...

Improper Verification Of Cryptographic Signature

Spring Security is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to SAML Responses and LogoutRequest/LogoutResponse elements being decrypted without requiring a valid signature, which allows an attacker to craft malicious SAML payloads and use the Servic...

CVE-2026-73673 Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-74244: Improper Verification of Cryptographic Signature

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

CVE-2026-64887: Use of Hard-coded Cryptographic Key

Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1...

CVE-2026-47192: Improper Verification of Cryptographic Signature

kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the...

CVE-2026-47191: Improper Verification of Cryptographic Signature

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

SAP NetWeaver AS Java Vulnerable Third-Party Component (3758318)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by the use of a vulnerable third-party component as referenced in SAP Security Note 3758318: - SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data...

CVE-2026-17468

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

CVE-2026-73576

CVE-2026-73576 affects Zimbra Collaboration (ZCS) before 10.1.17 via the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated with an insecure RNG, yielding insufficient entropy. This may allow offline brute-forcing to recover the JWT signing secret, enabling JWT forgery and po...

AZL-95723 CVE-2026-14663 affecting package postgresql for versions less than 16.15-1

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...