CVE-2026-98845: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

PT-2026-116618

Name of the Vulnerable Software and Affected Versions LobsterAI versions prior to 2026.10.16 Description An issue exists where exported provider API keys are encrypted using a hardcoded password 'lobsterai-APP'. An attacker who obtains a provider export file can use this constant with PBKDF2 a ke...

PT-2026-117086

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cache key decode takes a key's logical off from the cache device and later indexes req key tree-subtrees by it in get subtree. An off past the device forms a subtree...

CVE-2026-112014: Use of Hard-coded Cryptographic Key

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

PT-2026-117064

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

Linux Distros Unpatched Vulnerability : CVE-2026-98805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM...

Security update for python-virtualenv (important)

openSUSE security update: security update for python-virtualenv ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22100-1 Rating: important References: bsc1283890 bsc1283904 Cross-References: CVE-2026-102930 CVE-2026-102938 CVSS scores: CVE-2026-10293...

CVE-2026-111927

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

EUVD-2026-103294

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 6.11.7 to 6.12 and version 6.12 contain security vulnerabilities. These vulnerabilities arise when the TPM empty key name does not match, resulting in the chip not being disabled and a success return being given. This allows uninitialized stack values to be used as...

WordPress Electronic Signature Add-on for Fluent Forms Authorization Issue Vulnerability

The WordPress Electronic Signature Add-on for Fluent Forms 2.0.5 and earlier versions has an authorization issue vulnerability. This vulnerability stems from bypassing authorization through the user-controlled key, which may lead to security breaches if the access control levels are improperly...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel from 6.1.119 to 6.1.189, from 6.6.63 to 6.6.158, from 6.11.10 to 6.12, and version 6.12 contain security vulnerabilities. The vulnerability stems from inconsistent IDR key fields in the manual hashtable handles in net/sched clsu32. Hashtables created with an explicit...

CVE-2026-103376

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...

CVE-2026-103376 PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...

CVE-2026-103376 PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...

CVE-2026-103376

The PeachPay — Payments & Express Checkout for WooCommerce WordPress plugin, versions 1.117.9 through 1.120.69 , is vulnerable to unauthenticated order key disclosure. The software fails to perform necessary capability or ownership checks before returning an order's secret key in response to an u...

WordPress PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) plugin 1.117.9-1.120.69 - Unauthenticated Order Key Disclosure vulnerability

Unauthenticated Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PeachPay Payments versions 1.117.9-1.120.69...

EUVD-2026-103255

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...

CVE-2026-103376: Exposure of Sensitive Information to an Unauthorized Actor

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...