CVE-2026-85296

The Apache Camel AS2 component is vulnerable to cross-partner signing key confusion due to improper state management. The root cause is that signing material for individual requests is stored in shared state rather than being confined to the specific request. This allows concurrent or successive ...

CVE-2026-85296

Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined ...

mariadb: MariaDB: Privilege escalation via ACL cache key collision

A flaw was found in MariaDB. An issue in the Access Control List ACL cache causes identical privilege cache keys to be generated when a role and a local user share the same name. An attacker with user creation privileges can exploit this key collision by creating a matching account, allowing them...

openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without prope...

openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without prope...

curl: SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections

The core effect is a silent host-authentication bypass: a transfer whose configured SSH host-key policy would reject the server is served anyway, with exit code 0 and no warning, because it reuses a pooled connection established under a weaker or absent policy. curl may assess this lower because ...

K000163771: libxslt vulnerability CVE-2025-7425

Security Advisory Description A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As...

CVE-2026-112268: Incorrect Authorization

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

openSUSE 16 Security Update : python-virtualenv (openSUSE-SU-2026:22100-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22100-1 advisory. - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. - CVE-2026-102938: crafted prompt...

PT-2026-117412

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

Multi-Path Security in Quantum Networks with Trusted Nodes

Quantum communication networks promise information-theoretic security but this security collapses if intermediate relay nodes are compromised, a risk that grows sharply when compromised nodes cannot be identified. We address this twofold: first, we show that multi-path routing provides quantifiab...

Orchestrating Key Scarcity: Global Capacity Allocation in Hybrid QKD-PQC Networks

This article presents a Distributed Key Management System DKMS that provisions quantum-safe symmetric encryption keys to applications across a network. To overcome the distance and rate limitations inherent to Quantum Key Distribution QKD, the architecture adopts a hybrid design: it utilizes...

PT-2026-117364

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...

PT-2026-118014

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza...

PT-2026-117357

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

RHEL 10 / 7 / 8 / 9 : Satellite 6 Client Update (Moderate) (RHSA-2026:85249)

The remote Redhat Enterprise Linux 10 / 7 / 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:85249 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessi...

CVE-2026-85300: Incorrect Default Permissions

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

CVE-2026-85296: Exposure of Data Element to Wrong Session

Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined ...

PT-2026-117997

Summary russh keys::agent::server::add key russh/src/keys/agent/server.rs:271-319 spawns a dedicated tokio task for every 5-byte SSH AGENT CONSTRAIN LIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime up to 136 years. The loop has no...

CVE-2026-110672: Missing Release of Memory after Effective Lifetime

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...