29594 matches found
PT-2026-70900
The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy BLE interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when ...
PT-2026-70187
Name of the Vulnerable Software and Affected Versions LOGO! Soft Comfort versions prior to V9 Description Products use a static, hardcoded AES master key to encrypt project files. A local attacker could extract this master key from the application files or memory to decrypt project files or remov...
PT-2026-70672
Name of the Vulnerable Software and Affected Versions Windows Active Directory affected versions not specified Description Inadequate encryption strength allows an authorized attacker to bypass a security feature over a network, which can lead to an impact on the system. Recommendations At the...
Apache Tomcat 9.0.116 < 9.0.117 Missing Encryption of Sensitive Data Vulnerability (CVE-2026-34486)
The version of Tomcat installed on the remote host is 9.0.116 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146...
PT-2026-70864
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in Queryable Encryption maintenance operations allows an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of da...
CVE-2026-18691: Selection of Less-Secure Algorithm During Negotiation
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to ...
CVE-2026-18712: Incorrect Authorization
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...
PT-2026-70836
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue exists in the handling of a Queryable Encryption maintenance operation where certain request parameters are not properly validated against the encrypted field configuration of...
CVE-2026-18687: Integer Underflow (Wrap or Wraparound)
MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a...
UBUNTU-CVE-2026-68148
In the Linux kernel, the following vulnerability has been resolved: fscrypt: Add missing superblock check in findorinsertdirectkey The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies that have FSCRYPTPOLICYFLAGDIRECTKEY. It's just a global table for all...
CVE-2026-68148 fscrypt: Add missing superblock check in find_or_insert_direct_key()
In the Linux kernel, the following vulnerability has been resolved: fscrypt: Add missing superblock check in findorinsertdirectkey The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies that have FSCRYPTPOLICYFLAGDIRECTKEY. It's just a global table for all...
EUVD-2026-55532
In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...
CVE-2026-68125
CVE-2026-68125 (Linux kernel, mac802154 llsec) : A logic flaw in llsec_do_decrypt_auth() computes assoclen as datalen - authlen without validating that the frame carries at least authlen payload bytes. This allows an attacker-controlled IEEE 802.15.4 frame with payload shorter than the authentica...
CVE-2026-68125 mac802154: llsec: reject frames shorter than the authentication tag
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsecdodecryptauth computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC...
CVE-2026-21079
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data...
CVE-2026-21079
CVE-2026-21079 concerns Samsung Smart Switch prior to version 3.7.72.6, where missing encryption of sensitive data allows adjacent attackers to intercept transmitted data. The affected component is the Smart Switch data transmission flow; the root cause is lack of encryption for sensitive data in...
CVE-2026-21079
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data...
CVE-2026-21079
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data...
