Astra Linux – Vulnerability in Node-Elliptic

The ECDSA implementation of the Elliptic package generates incorrect signatures if the intermediate value ‘k’ calculated based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to the exposure of the secret...

CVE-2025-47423

CVE-2025-47423 – Local File Inclusion in Personal Weather Station Dashboard 12lts Discovered by: Matthew Eagle Status: Public Disclosure Date Reported: 2025-05-05 CVE ID: CVE-2025-47423 🧩 Summary A Local File Inclusion LFI vulnerability in the Personal Weather Station Dashboard version 12lts allo...

CVE-2026-16001

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

CVE-2026-16001 IesEngine stream-mode MAC forgery via length-dependent KDF split

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

EUVD-2026-91206

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

PT-2026-104102

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103281

The Ghost (npm package 'ghost') content management system versions 3.23.0 up to, but not including, 6.23.0 contains a vulnerability where it exposes API keys to users with low-privilege staff accounts. The root cause allows an authenticated low-privilege staff user to read API keys returned by th...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-100708

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

CVE-2026-100708

Froxlor versions before 2.3.13 are vulnerable to private key disclosure via the Certificates.get and Certificates.listing API commands. The root cause is that the results of underlying domain_ssl_settings queries are processed by ApiCommand::response() without any field stripping or allowlist, ca...

EUVD-2026-87681

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

CVE-2026-86708

ZohoCorp ManageEngine Applications Manager versions 182200 and below are vulnerable to the exposure of a Google Cloud service-account private key within the Applications Manager installer. This sensitive data exposure allows an unauthenticated attacker to impersonate the service account, potentia...

EUVD-2026-85288

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: tang (UTSA-2023-002173)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002173 advisory. A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become...

JFrog Artifactory < 7.146.35 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.146.35. It is, therefore, affected by the following vulnerabilities. - An authentication weakness that, under default configuration, may allow an unauthenticated attacker wit...

CVE-2026-89278: Exposure of Sensitive Information to an Unauthorized Actor

The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueuefrontendscripts. This makes it possible for unauthenticated attackers to...

openSUSE 16: libknet-devel / libknet1 / libknet1-compress-bzip2-plugin / etc (openSUSE-SU-2026:21851-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21851-1 advisory. - CVE-2026-15811: improper sanitization of sensitive memory locations following cryptographic configuration adjustments can lead to potential...