CVE-2026-88032: Use After Free

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...

PT-2026-89364

Name of the Vulnerable Software and Affected Versions Hikvision intercom products affected versions not specified Description Certain intercom products use an immutable factory value for main card authentication. This value, which is intended to be retrieved via physical interaction or a local...

PT-2026-89546

Name of the Vulnerable Software and Affected Versions MongoDB Java Driver affected versions not specified Description A use-after-free issue exists in the reactive client-side encryption component. This occurs when an encrypted operation is cancelled, causing native resources to be freed while th...

EUVD-2026-75111

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-73334

The org.apache.parquet.crypto.keytools package in Apache Parquet (versions 1.12 to 1.18) is vulnerable to a Server-side Request Forgery (SSRF) due to a host validation bypass. When the KMS URL is file-controlled rather than application-controlled, the FileKeyUnwrapper forwards the URL to a plugga...

CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

CVE-2026-87735

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption...

CVE-2026-87735

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption...

EUVD-2026-74621

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption...

CVE-2026-87735

An issue in the mirage-crypto-pk OCaml package before version 2.3.0 triggers an undocumented exception when processing a small message during RSA decryption or encryption . The vulnerability is rated MEDIUM (CVSS 4.3) , with a network attack vector, low complexity, and low privileges required, re...

firezone headless-client-1.5.12

Blazing-fast remote access with identity-based policies, attested device trust, and detailed audit logs Documentation | Quickstart | Download Clients | Support Overview Firezone is a secure remote access platform built on WireGuard®. Connect users to private applications, databases, servers, and...

CVE-2026-53939

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...

DEBIAN-CVE-2026-53939

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...

PT-2026-89110

MaxSite CMS through 109.6 passes the ci session cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achiev...

PT-2026-88925

Name of the Vulnerable Software and Affected Versions Apache Parquet versions 1.12 through 1.18 Description The org.apache.parquet.crypto.keytools package allows for the encryption of Parquet files using an envelope encryption mechanism that wraps data keys via a Key Management Service KMS. When...

CVE-2026-53939: Use of Hard-coded Cryptographic Key

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...

CVE-2026-87735: Improper Validation of Specified Quantity in Input

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption...

CVE-2026-87930: Deserialization of Untrusted Data

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-53939 OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...