833 matches found
CVE-2026-38447
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...
CVE-2025-15629
CVE-2025-15629 affects TP-Link Omada adoption protocol. A cryptographic weakness causes session encryption keys used between controllers and managed devices to be generated with insufficient entropy, making them potentially predictable. If an attacker can intercept adoption-related communications...
CVE-2026-65007
The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...
CVE-2026-65007 Grav before 1.0.8 Missing Authorization on API Key Generation
The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...
CVE-2026-65007
The Grav api plugin (grav-plugin-api) prior to v1.0.8 fails to properly authorize API key generation and revocation. It intercepts apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes callers solely on admin.login, the baseline permission for all panel use...
CVE-2026-65007 Grav before 1.0.8 Missing Authorization on API Key Generation
The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...
CVE-2026-11403
The CVE affects Sonatype Nexus Repository Manager. The flaw is in the format-specific API key generation, where a remote attacker could gain unauthorized access to repository operations as a targeted user if a format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token)...
Amazon Linux 2 : opensc, --advisory ALAS2-2026-3492 (ALAS-2026-3492)
The version of opensc installed on the remote host is prior to 0.19.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3492 advisory. A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of t...
PYSEC-2026-1325 Minerva timing attack on P-256 in python-ecdsa
python-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the ecdsa.SigningKey.signdigest API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key generation, and ECDH...
PYSEC-2026-748 SaltStack RSA Key Generation allows remote users to decrypt communications
SaltStack RSA Key Generation allows remote users to decrypt communications...
SUSE-SU-2026:2678-1 Security update for opensc
This update for opensc fixes the following issues - CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses bsc1261214. - CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write bsc1261220. - CVE-2026-10275: global buffer overflow duri...
EUVD-2026-39394
Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys...
CVE-2026-2815
The CVE affects Silicon Labs’ EFR32xG27 devices. Issue: Incorrect use of the PUF key for user key generation leads to predictable keys. This is tied to a CVSS 4.0 base score of 8.4 (HIGH) with adjacent access, low attack complexity, no authentication, and user interaction not required. The vulner...
CVE-2026-2815 Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys
Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys...
CVE-2026-56237 Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation
Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key...
Updated opensc packages fix security vulnerabilities
These packages fix security vulnerabilities: CVE-2026-10275, A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is...
PT-2026-54533
Уязвимость программного обеспечения управления аккаунтами JetBrains Hub связана с ошибками в коде генератора псевдослучайных чисел при генерации ключей хоста. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить полный контроль над приложением...
kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Use checkaddoverflow to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetrickeyid structure and return...
RHEL 10 : java-21-ibm-semeru-certified-jdk (RHSA-2026:22328)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22328 advisory. The IBM Semeru Runtime Certified Edition 21 runtime environment. Security Fixes: freetype: Information disclosure or denial of service via...
