CVE-2026-84971 Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

CVE-2026-84971

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

CVE-2026-84971 Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

CVE-2026-84971

CVE-2026-84971 affects MongoDB's client-side encryption library (mongocrypt) . The root cause is improper handling of an undersized FLE2 insert-update ciphertext in the decryption path, which triggers a failed internal check that terminates the process using the library, causing a persistent clie...

CVE-2026-84971 Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

CVE-2026-85175

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

cryptr v4.0.0

cryptr A simple shell utility for encrypting and decrypting files using OpenSSL. Installation git clone https://github.com/nodesocket/cryptr.git ln -s "$PWD"/cryptr/cryptr.bash /usr/local/bin/cryptr Requirements shred if optionally deleting original file. Bash tab completion Add...

EUVD-2026-70410

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

CVE-2026-85175

SiYuan versions ≤ 3.8.1 contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go) that only blocks conf/conf.json by exact match but fails to restrict the TLS private key (conf/key.pem) and CA private key (conf/ca.key). Because the getFile handler skips the ...

CVE-2026-85175 SiYuan before v3.8.2 TLS Private Key Disclosure via getFile

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

PT-2026-85267

A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...

CVE-2026-84971: Reachable Assertion

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

PT-2026-85074

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the...

CVE-2026-75136

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a...

CVE-2026-75136 UpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a...

CVE-2026-75135 UpSignOn < 7.19.0 Sensitive Key Retention in Memory

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

CVE-2026-75135

UpSignOn for Windows before 7.19.0 retains a backup key in the process memory of UpSignOn.exe even after the vault has been re-locked. A local attacker with low privileges can extract this key, decrypt the encrypted master password backup in v6-vault1.DATA.txt , and subsequently decrypt the entir...

EUVD-2026-70260

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

openssl: Possible NULL Dereference in Password-Based CMS Decryption

A flaw was found in OpenSSL. A remote attacker could exploit a NULL pointer dereference vulnerability in the Cryptographic Message Syntax CMS decryption process by providing a specially crafted password-encrypted CMS message. This occurs because the keyDerivationAlgorithm field, which is optional...