CVE-2026-77140

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...

EUVD-2026-65336

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...

CVE-2026-77140

TYPO3 extension Telephone Directory (telephonedirectory) suffers from a Broken Access Control flaw. The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, but not in the action that persists the change. As a result, an unauthenticated visi...

CVE-2026-77140 Broken Access Control in extension "Telephone Directory" (telephonedirectory)

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...

CVE-2026-76847

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-76847

act (nektos/act) versions 0.2.81 through 0.2.89 are affected by a missing authorization flaw in the Artifacts V4 backend , which is started whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. Three compounding issues enable unauthenticated artifact access: (1) val...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

EUVD-2026-64852

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fixed an invalid unregistererrorpath path. The error path of seg6init is incorrect when the CONFIGIPV6SEG6LWTUNNEL configuration option is not defined. In such cases, if seg6hmacinit fails, the genlunregisterfamily...

Astra Linux – Vulnerability in Python 2.7, Python 3.7

A issue was discovered in the comparedigest function in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimizations were possible in the accumulator variable used in hmac.comparedigest...

Astra Linux – Vulnerability in Samba

Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realized through netlink using four attributes:...

PT-2026-80856

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...

CVE-2026-75870

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie...

CVE-2026-75870 Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie...

CVE-2026-75870

CVE-2026-75870 affects the Punk Perl web framework (by LNATION) in versions before 0.18 . When the session keyword is declared without a secret option (or with an undefined/empty one), both cookie read and write-back default the HMAC key to an empty string , resulting in a zero-length HMAC-SHA256...

EUVD-2026-64294

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie...

CVE-2025-30156

A flaw was found in the CephX authentication protocol used by Ceph, a distributed storage system. CephX uses AES-128-CBC encryption with a hardcoded initialization vector and no message authentication HMAC, making it vulnerable to the same class of unauthenticated-encryption attacks that...

EUVD-2026-63579

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...