CVE-2026-110455

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device...

CVE-2026-110454

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

EUVD-2026-100815

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

CVE-2026-110454

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

CVE-2026-110454

The UniFi Protect AI Key is affected by an Improper Access Control vulnerability (CWE-284). A malicious actor with network access could exploit this flaw to gain access to internal resources through the device. No specific details regarding the root cause, affected versions, or remediation steps ...

CVE-2026-110612: Use of Hard-coded Cryptographic Key

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on...

PT-2026-114103

A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the...

CVE-2026-98407: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

ALSA-2026:82883 Important: hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project HPLIP, which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fixes: hplip: HP Linux Imaging and Printing Software - Use of DSA Key CVE-2025-43023 hplip: HPLIP: Multiple...

ALSA-2026:82882 Important: hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project HPLIP, which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fixes: hplip: HP Linux Imaging and Printing Software - Use of DSA Key CVE-2025-43023 hplip: HPLIP: Multiple...

Rocky Linux 10.2 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel (crlsa-2026_80605)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680605 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description block...

Important: dnsmasq

Issue Overview: Amazon Linux–vended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled, this could result in DNS resolution failures, including for names in unsigned zones. This applies where the resolver is still using the trust ancho...

PT-2026-113646

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device...

PT-2026-113641

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

PT-2026-113645

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device...

PT-2026-113673

The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate...

PT-2026-113701

An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-68964): Gitea -- multiple vulnerabilities

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key...

CVE-2026-73793: Deserialization of Untrusted Data

HPE NonStop Middleware software has secret key handling and data deserialization vulnerability...

PT-2026-114031

Name of the Vulnerable Software and Affected Versions S3 .NET Encryption Client versions prior to 3.2.2 S3 .NET Encryption Client versions prior to 4.0.3 Description A padding oracle flaw exists in the S3 .NET Encryption Client. A remote user with read access to encrypted objects in an S3 bucket...