59091 matches found
SUSE-SU-2026:24243-1 Security update for python-virtualenv
This update for python-virtualenv fixes the following issues: - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. - CVE-2026-102938: crafted prompt values with line boundaries can cause configuration key injection bsc1283890...
WordPress WP Encryption plugin < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement vulnerability
Unauthenticated Certificate Private Key and ACME Order Replacement vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content versions 7.8.8.2...
RUSTSEC-2026-0349 Unauthenticated ServerHello can downgrade later connections to classical key exchange
The client recorded the server-selected key exchange group for each server name when processing the ServerHello, before the server was authenticated. This record is used to predict which key share to send in future ClientHellos to that server name. A network attacker can answer one connection...
Unauthenticated ServerHello can downgrade later connections to classical key exchange
The client recorded the server-selected key exchange group for each server name when processing the ServerHello, before the server was authenticated. This record is used to predict which key share to send in future ClientHellos to that server name. A network attacker can answer one connection...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the wolfSSL backend during the TLS handshake process. An attacker can cause improper authorization of an invalid key by presenting a specially crafted certificate with a manipulated validity length...
curl: curl: wolfSSL public-key pinning bypass
A flaw was found in curl. This vulnerability allows a malicious server to bypass public key pinning when curl is built with the wolfSSL backend. By presenting a specially crafted certificate with a manipulated validity length field, the attacker can trick curl into improperly re-parsing the...
curl: curl: knownhost callback mismatches key as missing
A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell SSH connection c...
CVE-2026-73793
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability...
Check Point Reports LiteLLM Flaws Enabling Admin Takeover and API Key Theft
Check Point Research found two LiteLLM vulnerabilities that could let low-privilege users execute code, access sensitive files, hijack admin accounts, and steal AI provider API keys...
CVE-2026-109969 Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...
CVE-2026-109969
A flaw exists in the clevis PKCS#11 pin where the clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, a local user can connect to the control socket to inject arbitrary device...
CVE-2026-109969 Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...
CVE-2026-73793
The HPE NonStop Middleware software contains a secret key handling and data deserialization vulnerability (CWE-502). Impact includes potential Denial of Service (DoS) , memory corruption , Buffer Overflow , and Stack Overflow on affected systems. The vulnerability affects multiple components, inc...
EUVD-2026-100948
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability...
CVE-2026-73793 HPE NonStop Middleware - Secret key handling vulnerability
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability...
CVE-2026-73793 HPE NonStop Middleware - Secret key handling vulnerability
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability...
BIT-KIBANA-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...
BIT-GITEA-2026-79960 Gitea deploy key pushes acting as the repository owner
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
BIT-ELK-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...