CVE-2026-105193: Inadequate Encryption Strength

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then...

GHSA-53VV-XM9F-MM82 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 u...

NPM: Ghost: Password Hash Ordering Disclosure in Ghost Admin API

NPM: Ghost: Password Hash Ordering Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions = 0.7.2, 6.64.0...

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 u...

Exploit for CVE-2026-81780

CVE-2026-81780 — Hash Form ≤ 1.4.2 Unauthenticated RCE !CVE...

CVE-2026-98281

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...

CVE-2026-98281 futex: Also allocate private hash on vfork()

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...

CVE-2026-94206 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...

CVE-2026-94206

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...

[SECURITY] Fedora 45 Update: ocaml-sha-1.15.4-21.fc45

A binding for SHA interface code in OCaml. This packages offers the same interface as the MD5 digest included in the OCaml standard library. It currently provides SHA1, SHA256 and SHA512 hash functions...

[SECURITY] Fedora 45 Update: ocaml-ppx-hash-0.17.0-17.fc45

Ppxhash is a ppx rewriter that generates hash functions from type expressions and definitions...

CVE-2026-94206: Use of Password Hash With Insufficient Computational Effort

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...

CVE-2026-105652 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

CVE-2026-105652

The Ghost Node.js content management system is vulnerable to a Password Hash Ordering Disclosure in its Admin API. In versions 0.7.2 through 6.64.0 , any user with staff-level privileges could determine the relative ordering of other staff users' hashed passwords. While this vulnerability does no...

CVE-2026-105652 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

CVE-2026-105652 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

CVE-2026-105156

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launch...

CVE-2026-105156 YzmCMS MD5 system.func.php password weak password hash

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launch...

CVE-2026-105156 YzmCMS MD5 system.func.php password weak password hash

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launch...

EUVD-2026-92096

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launch...