CLEANSTART-2026-EH37235 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

Security vulnerability affects the grafana-fips package. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources...

PT-2026-118316

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only...

CVE-2012-20003: Improper Neutralization of Input During Web Page Generation

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...

Observable-Level Framework for Finite-Key Security in Coherent-One-Way Quantum Key Distribution

Practical security analysis of Coherent-One-Way COW quantum key distribution requires optical-device modeling, finite experimental statistics, and security inference to be treated consistently without conflating assumptions. We present a modular observable-level simulation framework organized...

PT-2026-120295

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

Ubuntu: USN-8927-1 (CVE-2026-87865): curl vulnerabilities

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

PT-2026-118251

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server...

Apache Camel 4.22.0 camel-pqc Private Key Permissions

Apache Camel camel-pqc versions from 4.12.0 before 4.18.5 and from 4.19.0 before 4.22.1 write unencrypted private keys using default file permissions, allowing local accounts to read them under a permissive umask. A proof of concept is included. https://packetstorm.news/download/236481...

PT-2026-118420

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions 1.3.0.Final through 1.3.1.Final Description The AndroidA2AHttpClient synchronous POST path incorrectly overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with a default followRedirects value ...

PT-2026-118435

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the NX CRYPTO MAX RSA MODULUS SIZE default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a...

PT-2026-119556

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.1 through 12.2 Description A remote attacker could obtain sensitive information because the software uses a hard-coded cryptographic key. A hard-coded cryptographic key is a fixed key embedded directly...

WS-2026-0133

certifi 2019.03.09 through 2026.07.22 ships the "emSign ECC Root CA - G3" root certificate in its CA bundle certifi/cacert.pem. Intermediates under this root were revoked for key compromise cACompromise, so certificates issued with the compromised CA keys are trusted by applications that use...

PT-2026-118407

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

PT-2026-118672

Name of the Vulnerable Software and Affected Versions Custom Tables plugin for WordPress versions prior to 3.4.6 Description A reflected cross-site scripting issue exists that allows unauthenticated attackers to inject scripts into victims' browsers to steal cookies. This occurs via the unsanitiz...

Apache Camel 4.22.0 AS2 MDN Signing Key Confusion

Apache Camel version 4.22.0 AS2 component contains a race condition that can cause Message Disposition Notifications in multi-partner deployments using dynamic keys to be signed with a different partner's private key. https://packetstorm.news/download/236482...

PT-2026-118363

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

VulnCheck KEV: CVE-2012-20003

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...

Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2026-77369)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-77369 advisory. - CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap Resolves: RHEL-256961 modauthopenidc Tenable has extracted the preceding description...

Atlassian Jira Service Management Data Center and Server 3.0.x < 10.3.26 / 10.4.x < 11.3.12 (JSDSERVER-16790)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16790 advisory. - In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC...

Atlassian Jira Service Management Data Center and Server < 10.3.13 / 10.4.x < 11.1.1 (JSDSERVER-16831)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16831 advisory. - In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpe...