CVE-2026-111347 go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP...

CVE-2026-111347 go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP...

CVE-2026-111347

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP...

CVE-2026-111347

The go-ldap-admin tool, versions up to and including 0.6.2 , contains a hard-coded RSA private key within its public repository. This key is used to protect encrypted login passwords. Unauthenticated attackers can recover cleartext LDAP credentials by capturing encrypted passwords and decrypting ...

CVE-2026-111321

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-94135

The Apache Airflow SFTP provider's deferrable code paths "SFTPTrigger", "SFTPHookAsync", "SFTPClientPool" disable SSH host-key verification by default unless the connection explicitly sets "nohostkeycheck" to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. A...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-94135

The Apache Airflow SFTP provider contains a vulnerability where the deferrable code paths (SFTPTrigger , SFTPHookAsync , and SFTPClientPool ) disable SSH host-key verification by default. This occurs unless the connection explicitly sets no_host_key_check to false. Affected deployments running SF...

CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...

CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...

CVE-2026-94134

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless "hostkey" is configured or "nohostkeycheck" is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle...

CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...

CVE-2026-94134

The Apache Airflow SSH provider hook contains a vulnerability where it disables SSH host-key verification by default. Unless a host_key is configured or no_host_key_check is explicitly set to false, the hook accepts any server key. This affects both SSH and SFTP connections and allows an attacker...

CVE-2026-105035

The EnergizeLab FirmwareUpdater AArch64 ELF, distributed in the CDN bin.zip uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an uncontrolled resource consumption due to js-yaml (CVE-2026-84375)

Summary There is a vulnerability in the js-yaml library that affects IBM WebSphere Application Server and WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-84375 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1,...

CVE-2026-105035

The EnergizeLab FirmwareUpdater (AArch64 ELF, located in the bin.zip CDN file) is vulnerable to a hard-coded AES key (CWE-321) shared across all installations. An attacker capable of recovering this key from the updater can decrypt and forge firmware packages for any device that trusts the update...

EUVD-2026-102431

The EnergizeLab FirmwareUpdater AArch64 ELF, distributed in the CDN bin.zip uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it...

CVE-2026-105035 EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key

The EnergizeLab FirmwareUpdater AArch64 ELF, distributed in the CDN bin.zip uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it...