CVE-2026-59644

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

UBUNTU-CVE-2026-59644

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644 MLS hash-ratchet honours arbitrary 32-bit generation counter from sender

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644 MLS hash-ratchet honours arbitrary 32-bit generation counter from sender

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644 MLS hash-ratchet honours arbitrary 32-bit generation counter from sender

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644

CVE-2026-59644 affects Bouncy Castle for Java up to version 1.84, where the MLS hash-ratchet may honor an arbitrary 32-bit generation counter from the sender. This can impact availability (per CVSS: HIGH) with no confidentiality or integrity impact reported, and no exploitation details are provid...

CVE-2026-59644

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

EUVD-2026-52030

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644: Excessive Iteration

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

PT-2026-67345

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a...

PT-2026-67237

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Description The MLS hash-ratchet mechanism accepts an arbitrary 32-bit generation counter provided by the sender. A hash-ratchet is a cryptographic process used to derive new keys for each message ...

PT-2026-67467

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

hate_crack v2.24.1

root@kitploit: / | \ / | \ \ | | / \ \ / \ / \ /\ \ \ / | |/ / \ Y // | | \ / \ | | // \ | \ /|| /\ | \ / / // / / / / Installation Installing from source is the only supported path. hatecrack is not distributed on PyPI: pip install hate-crack resolves to a 0.0.0 placeholder that...

goshs v2.1.5

You're mid-engagement. You need to transfer a file, catch an SMB hash, or stand up a quick HTTPS server — and python3 -m http.server won't cut it. goshs is a single-binary file server built for the moments when you need more than Python's SimpleHTTPServer but don't want to configure Apache. HTTP/...

AlmaLinux 9 : kernel (ALSA-2026:47040)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47040 advisory. kernel: xfrm: Duplicate SPI Handling CVE-2025-39797 kernel: lib/buildid: use kernelread for sleepable context CVE-2026-23002 kernel: futex: Drop...

RUSTSEC-2026-0232 Processing of unverified relay events

The processed events received from a relay through admission-policy and database paths before verifying that the serialized fields matched the claimed event ID and signature. In particular, a database result for the claimed ID could cause verification to be skipped. The verification cache also...

PT-2026-76516

The processed events received from a relay through admission-policy and database paths before verifying that the serialized fields matched the claimed event ID and signature. In particular, a database result for the claimed ID could cause verification to be skipped. The verification cache also...

Oracle Linux 9 : kernel (ELSA-2026-47040)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47040 advisory. - blk-mq: reinsert cached request to the list CKI Backport Bot RHEL-213163 CVE-2026-64017 - blk-mq: pop cached request if it is usable CKI Backport Bo...

UBUNTU-CVE-2026-53501

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...