CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...

CVE-2026-78292

CVE-2026-78292 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Hash Form , affecting versions

EUVD-2026-66569

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: skip hash tables in u32bindclass u32walk enumerates both struct tcuhnode and struct tcuknode through the walker callback. u32bindclass unconditionally casts the passed fh to tcuknode and accesses &n-res, so whe...

CVE-2026-19715

The WP OAuth Server ( Login with WordPress ) WordPress plugin in versions before 6.3.1 is vulnerable to an unauthenticated information disclosure. When debug logging is enabled, the plugin writes to a debug log stored at a fixed and publicly reachable location without restricting access. This all...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

Rockwell Automation OTTO Fleet Manager

ADVISORY SUMMARY Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

CVE-2026-81688: Missing Encryption of Sensitive Data

opensslencrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...

CVE-2026-80211: Use of Password Hash With Insufficient Computational Effort

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...

PT-2026-85190

openssl encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...

PT-2026-82465

Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...

PT-2026-82589

openssl encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...

CVE-2026-78292: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...

CVE-2026-76956

A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness entropy for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result ...

K000163111: jq vulnerability CVE-2026-40164

Security Advisory Description jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed 0x432A9843 for all JSON object hash table operations, which allowed an attacker to precompute key collisions...

AZL-97740 CVE-2026-74739 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: skip hash tables in u32bindclass u32walk enumerates both struct tcuhnode and struct tcuknode through the walker callback. u32bindclass unconditionally casts the passed fh to tcuknode and accesses &n-res, so whe...

CVE-2026-74739

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: skip hash tables in u32bindclass u32walk enumerates both struct tcuhnode and struct tcuknode through the walker callback. u32bindclass unconditionally casts the passed fh to tcuknode and accesses &n-res, so whe...

PT-2026-82119

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-out-of-bounds read occurs in the tc cls bind class function. This happens because u32 bind class unconditionally casts a passed fh to tc u knode and accesses &n-res. When fh is...

VulnCheck KEV: CVE-2023-34132

Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104778)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104778 advisory. Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database...

goshs v2.1.6

You're mid-engagement. You need to transfer a file, catch an SMB hash, or stand up a quick HTTPS server — and python3 -m http.server won't cut it. goshs is a single-binary file server built for the moments when you need more than Python's SimpleHTTPServer but don't want to configure Apache. HTTP/...