CVE-2026-113404 Uniong｜WebITR - Insecure Deserialization

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server...

EUVD-2026-104808

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server...

CVE-2026-113404

The software WebITR , developed by Uniong , contains an Insecure Deserialization vulnerability (CWE-502). Authenticated remote attackers can exploit this by utilizing a hard-coded cryptographic key to craft and submit malicious serialized data. Successful exploitation allows the attacker to achie...

CVE-2026-113404 Uniong｜WebITR - Insecure Deserialization

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server...

CLEANSTART-2026-UP46594 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh

CVE-2026-39831 affects multiple packages. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh. See references for individual vulnerability details...

CLEANSTART-2026-JL15396 RSA and DSA public key parsers did not enforce size limits on key parameters

CVE-2026-39829 affects multiple packages. The RSA and DSA public key parsers did not enforce size limits on key parameters. See references for individual vulnerability details...

CLEANSTART-2026-IY38231 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

CVE-2026-39835 affects multiple packages. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. See references for individual vulnerability details...

CLEANSTART-2026-EH37235 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

Security vulnerability affects the grafana-fips package. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources...

Atlassian Confluence 8.9.x < 9.2.24 / 9.3.x < 10.2.17 / 11.0.0 (CONFSERVER-104469)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104469 advisory. - In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle f...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46122)

In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check on firmware key index in b43rx The firmware-controlled key index in b43rx can exceed the dev-key array size 58 entries. The existing B43WARNON is non-enforcing in production builds, allowing an...

Atlassian Jira Service Management Data Center and Server < 10.3.26 / 10.4.x < 11.3.12 (JSDSERVER-16839)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16839 advisory. - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1,...

Atlassian Jira Service Management Data Center and Server 3.0.x < 10.3.26 / 10.4.x < 11.3.12 (JSDSERVER-16790)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16790 advisory. - In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC...

Atlassian Jira Service Management Data Center and Server < 10.3.13 / 10.4.x < 11.1.1 (JSDSERVER-16831)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16831 advisory. - In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpe...

CVE-2012-20003: Improper Neutralization of Input During Web Page Generation

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...

PT-2026-118316

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only...

Observable-Level Framework for Finite-Key Security in Coherent-One-Way Quantum Key Distribution

Practical security analysis of Coherent-One-Way COW quantum key distribution requires optical-device modeling, finite experimental statistics, and security inference to be treated consistently without conflating assumptions. We present a modular observable-level simulation framework organized...

PT-2026-118420

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions 1.3.0.Final through 1.3.1.Final Description The AndroidA2AHttpClient synchronous POST path incorrectly overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with a default followRedirects value ...

Linux Distros Unpatched Vulnerability : CVE-2026-110672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24...

PT-2026-120295

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

Ubuntu: USN-8927-1 (CVE-2026-87865): curl vulnerabilities

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...