CVE-2026-110672

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

CVE-2026-110672

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

CVE-2026-110672

The Cpanel::JSON::XS Perl module versions before 4.80 are vulnerable to a memory leak in the decode_hv function. The issue occurs when a quoted key of 24 or more bytes, or one containing non-ASCII bytes/escape sequences, is decoded into a new scalar. If the object is subsequently rejected due to ...

CVE-2026-97629

A flaw was found in nginx. Under specific configurations where shared SSL session caching is enabled without explicit session ticket key rotation, a remote unauthenticated attacker may be able to forge client Secure Sockets Layer SSL sessions. This flaw allows an attacker to bypass client...

Moderate: Red Hat Security Advisory: Satellite 6 Client Update

Updated Satellite Client packages that fix several bugs are now available for Red Hat Satellite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

WordPress Custom Tables: Cross-site Scripting Vulnerabilities

Versions of WordPress Custom Tables prior to 3.4.6 contained a cross-site scripting vulnerability. This vulnerability stemmed from the uncleaned key parameter in the iframe.php file. It could lead to reflective XSS attacks. Unauthenticated attackers could construct GET requests to execute scripts...

MinIO encryption issues and vulnerabilities

MinIO RELEASE.2025-10-15T17-29-55Z and earlier versions have a security vulnerability. This vulnerability stems from the globalDeploymentID/SessionTokenAuthenticate function in the Embedded Console component, which uses a hard-coded encryption key. This vulnerability can be exploited remotely...

Curl encryption vulnerability

The curl version 8.22.0 and earlier have an encryption-related vulnerability. This vulnerability arises when libcurl uses libssh2 to process the hash of the knownhosts file. In this case, unrelated initial entries can cause host key verification to falsely report a key mismatch as a key absence...

Curl encryption issue vulnerability

Versions 8.22.0 and earlier of curl contain an encryption vulnerability. This vulnerability arises when, during TLS handshake, curl re-parses the same certificate; due to manipulation of the validity length field, it extracts and matches a different embedded key while incorrectly authorizing the...

Security Bulletin: IBM Guardium Data Protection is affected by a security vulnerability (CVE-2026-82891)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-82891 DESCRIPTION: IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key. CWE:CWE-321: Use of...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the FileBasedKeyLifecycleManager in the PQC component. When it stores generated key material, a process umask that permits group or world access leaves the directory and unencrypted private-key JSON fil...

CVE-2026-112268

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-112268

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-112268 sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

EUVD-2026-104305

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-112268 sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-112268

The sglang-router (sgl-model-gateway) version 0.3.2 and below is vulnerable to an authorization bypass due to insufficient access control on mesh HA management routes . Specifically, the */ha/ endpoints fail to perform required control-plane Admin role checks. This allows holders of a standard da...

CVE-2026-112268 sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

EUVD-2026-104326

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1...