Microsoft Begins NTLM Phase-Out With Three-Stage Plan to Move Windows to Kerberos

Microsoft has announced a three-phase approach to phase out New Technology LAN Manager NTLM as part of its efforts to shift Windows environments toward stronger, Kerberos-based options. The development comes more than two years after the tech giant revealed its plans to deprecate the legacy...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : abseil-cpp (SUSE-SU-2026:0338-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0338-1 advisory. - CVE-2025-0838: Fixed heap buffer overflow in sized constructors, reserve, and rehash methods of...

CLEANSTART-2026-HT23337 flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm

Security vulnerability affects the gnupg package. A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm...

CVE-2020-37004

The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes from the tblusers database table. Attackers can exploit the /frontend/getarticlesuggestion/ endpoint by crafting malicious search paramete...

Security update for abseil-cpp

This update for abseil-cpp fixes the following issues: CVE-2025-0838: Fixed heap buffer overflow in sized constructors, reserve, and rehash methods of absl:flat,nodehashset,map bsc1237543. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Libgcrypt 1.12.0

Libgcrypt is a general-purpose cryptographic library based on the code from GnuPG. It provides functions for all cryptographic building blocks: symmetric ciphers AES, DES, Blowfish, CAST5, Twofish, and Arcfour, hash algorithms MD4, MD5, RIPE-MD160, SHA-1, and TIGER-192, MACs HMAC for all hash...

N3uron Web User Interface security vulnerabilities

N3uron Web User Interface is a browser-based graphical management interface developed by the Spanish company N3uron. Version 1.21.7-240207.1047 of N3uron Web User Interface contains a security vulnerability. This vulnerability stems from the use of the MD5 algorithm for client password hashing,...

📄 Qualcomm CVP Kernel Pointer Leak

The Qualcomm CVP driver exposes kernel pointers to userland by returning a hashed session ID derived from a kernel pointer using hash32ptr. This function is not a cryptographic hash but a reversible fold that XORs the upper and lower 32 bits of the pointer. Due to predictable ARM64 kernel virtual...

The vulnerability of the starfive_hash_digest() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the starfivehashdigest function in the Linux operating system is related to the lack of a mechanism for data type conversion. Exploiting this vulnerability could allow an attacker to cause a service failure...

php: heap-based buffer overflow in array_merge()

A flaw was found in PHP. A heap-based buffer overflow occurs in the arraymerge function when the total element count of packed arrays exceeds the 32-bit limit or the internal HTMAXSIZE due to an integer overflow in the precomputation of element counts using the zendhashnumelements function, causi...

php: heap-based buffer overflow in array_merge()

A flaw was found in PHP. A heap-based buffer overflow occurs in the arraymerge function when the total element count of packed arrays exceeds the 32-bit limit or the internal HTMAXSIZE due to an integer overflow in the precomputation of element counts using the zendhashnumelements function, causi...

Missing Release of Resource after Effective Lifetime

Overview github.com/grafana/grafana/pkg/api is an open and composable observability and data visualization platform. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the /avatar/:hash endpoint. An attacker can exhaust system memory and...

Grafana security vulnerabilities

Grafana is a set of open-source monitoring tools developed by Grafana Open Source, which provide a visual monitoring interface. This tool is primarily used for monitoring and analyzing Graphite, InfluxDB, and Prometheus. Grafana has a security vulnerability that arises from processing /avatar/:ha...

CVE-2025-38279

creationtimestamp| type| source ---|---|--- 2026-01-26 21:30:29+00:00| seen| Telegram/RI9kXhBuPq5wC8vdLmWReL7J6XxuEUTDnypgn872gf0Hg...

CLSA-2026-1769445556 php: Fix of CVE-2025-14178

CVE-2025-14178: fix heap buffer overflow in arraymerge due to integer overflow in zendhashnumelements precomputation...

CVE-2025-52026

An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint returns a list of cashier accounts, including names, email addresses, usernames, and passwords hashed using MD5. As MD5 ...

Fundamentals, Recent Advances, and Challenges Regarding Cryptographic Algorithms for the Quantum Computing Era

This book arises from the need to provide a clear and up-to-date overview of the impacts of quantum computing on cryptography. The goal is to provide a reference in Portuguese for undergraduate, master's, and doctoral students in the field of data security and cryptography. Throughout the chapter...

CVE-2026-23001 macvlan: fix possible UAF in macvlan_forward_source()

In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlanforwardsource Add RCU protection on struct macvlansourceentry-vlan. Whenever macvlanhashdelsource is called, we must clear entry-vlan pointer before RCU grace period starts. This allows...

SUSE SLES15 Security Update : gpg2 (SUSE-SU-2026:0214-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0214-1 advisory. - CVE-2025-68973: Fix possible memory corruption in the armor parser gpg.fail/memcpybsc1255715. - Avoid potential downgrade to SHA1 in 3rd...

K000159681: Credential harvesting campaign targeting F5 VPN users

On January 13, 2026, researchers identified a large-scale credential harvesting campaign targeting several VPN providers, including F5. The threat actors behind the campaign registered numerous doppelgänger domains designed to mimic legitimate F5 domains. These domains are used to deceive victims...