CVE-2026-77151

lin-snow Ech0 (versions up to 5.4.1 ) is affected by a cryptographic weakness in the MD5Encrypt function located in internal/util/crypto/crypto.go. The use of MD5 as a hashing algorithm is considered a risky cryptographic practice, as MD5 is known to be collision-prone and unsuitable for security...

CVE-2026-77151 lin-snow Ech0 crypto.go MD5Encrypt risky encryption

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an...

CVE-2026-69249 affecting package python-cryptography for versions less than 42.0.5-5

CVE-2026-69249 affecting package python-cryptography for versions less than 42.0.5-5. A patched version of the package is available...

MINI-XC9P-Q486-J2JQ

Bulletin has no description...

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

SummaryRepo under test: https://github.com/Netflix/lemurWhen ADMINONLYAUTHORITYCREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent field i...

CVE-2026-50577 ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves requestcounter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counte...

CVE-2026-74888

opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-cryptography: python3-cryptography-50.0.0-1.hum1 aarch64, x8664 python-cryptography-50.0.0-1.hum1.src src...

MINI-GPG7-5X8Q-7R8Q

Bulletin has no description...

MINI-HWHF-PCQC-4H74

Bulletin has no description...

postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers

A flaw was found in PostgreSQL pgcrypto. When using disabled ciphers, a user can recover cleartext data by observing faulty ciphertext. This issue arises because the application may accept encrypted data as input, leading to successful decryption even with an incorrect key. Consequently, the...

CVE-2026-73576

In Zimbra Collaboration ZCS before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with...

RHSA-2026:47117 Red Hat Security Advisory: libgcrypt security update

Bulletin has no description...

PT-2026-71682

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A weak cryptographic key generation issue exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, which lea...

CVE-2026-17616 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

CVE-2026-57263

A vulnerability has been identified in LOGO! Soft Comfort All versions V9. The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force...

RHSA-2026:52951 Red Hat Security Advisory: libgcrypt security update

Bulletin has no description...

Vulnerability of functions EllipticCurvePublicNumbers.public_key(), EllipticCurvePublicNumbers.public_key(), load_der_public_key(), and load_pem_public_key() in the Python-cryptography cryptographic library, which allows a perpetrator to gain access to confidential data

The vulnerabilities of the functions EllipticCurvePublicNumbers.publickey, EllipticCurvePublicNumbers.publickey, loadderpublickey, and loadpempublickey in the Python-cryptography cryptographic library are related to insufficient validation of data authenticity. Exploiting these vulnerabilities...

CVE-2024-14041

A flaw was found in Bouncy Castle for Java, affecting ML-KEM CRYSTALS-Kyber routines. Specifically, the Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines, which handle secret-derived polynomial coefficients, perform division by the modulus q. A remote attacker can exploit this...

Linux Distros Unpatched Vulnerability : CVE-2026-17510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute...