CVE-2026-81681

openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 advertise a portable USB workspace as an "Encrypted USB Workspace" with AES-256-GCM encryption and write a marker declaring it encrypted, but the workspace directory is actually stored in cleartext — the derived encryption key is neve...

CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...

CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...

CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...

EUVD-2026-67141

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...

BELL-CVE-2026-74706 CVE-2026-74706 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-74699 CVE-2026-74699 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-52492 CVE-2026-52492 does not affect BellSoft software

Bulletin has no description...

PT-2026-82604

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate the encryption status of embedded post-quantum cryptography PQC private keys within file metadata. This allows attackers to create files containing unencrypted...

DRUPAL-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098746)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098746 advisory. In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotifygetmarksafe may return false for a mark...

Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

CVE-2026-55618

eml_parser is a Python module for parsing .eml files. Prior to 3.0.2 , the clean_found_uri function in parser.py validates potential URL strings before unescaping HTML entities for colon, slash, or period characters. As a result, valid encoded URLs and their hostnames are rejected and omitted fro...

Insecure Default Initialization Of Resource

org.openidentityplatform.openam, openam-core is vulnerable to Insecure Default Initialization of Resource. The vulnerability is due to the default configuration setting the iPlanetDirectoryPro SSO cookie with HttpOnly=false while also using the cookie as a CSRF token in OAuth/OIDC flows, which...

CVE-2026-55530: Missing Authorization

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

CVE-2026-62986: Exposure of Sensitive Information to an Unauthorized Actor

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap data when reading a crafted deep scanline EXR that uses...

CVE-2026-72714

A flaw was found in Rocq Prover. When a module that locally disabled the universe checking flag is closed, the prover fails to restore the universe graph's copy of this flag. This desynchronization allows the kernel to accept terms that are inconsistent with the universe, even though the system...

CVE-2026-72714

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

CVE-2026-72714 Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

EUVD-2026-65143

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...