CVE-2026-72577 NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-66407

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...

CVE-2026-66407

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...

CVE-2026-66407

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...

CVE-2026-66407

CVE-2026-66407 affects DEEBOT PRO M1 and PRO K1VAC, where authentication in WebSocket communications is improperly implemented. According to sources, the WebSocket private key may be retrieved via a man-in-the-middle analysis of traffic, allowing an attacker to analyze and potentially alter commu...

EUVD-2026-55114

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...

Astra Linux – Vulnerability in wpa

In Hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker who has successfully bootstrapped public keys with another entity using PKEX in the past will be able to subvert future bootstrapping attempts by passively observing the public keys. By...

Astra Linux – Vulnerability in python-cryptography

Cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.5, the publickeyfromnumbers or EllipticCurvePublicNumbers.publickey, EllipticCurvePublicNumbers.publickey, loadderpublickey, and loadpempublickey functions did not verify...

PT-2026-69954

Name of the Vulnerable Software and Affected Versions odh-model-controller affected versions not specified Description An authenticated user with permissions to create custom resources can exploit a flaw in the loadSecret function. The function improperly reads the Secret namespace from...

PT-2026-69879

Name of the Vulnerable Software and Affected Versions Dokploy versions 0.28.7 through 0.29.12 Description The server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and executes the functions haveActiveServices, findServerById,...

Linux Distros Unpatched Vulnerability : CVE-2026-68148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fscrypt: Add missing superblock check in findorinsertdirectkey The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies...

...[ More ]

A proof of concept exploit for an authorization bypass vulnerability in Traefik version 3.7.9. The vulnerability affects the Kubernetes Gateway API provider and results from ambiguous dynamic configuration object identifiers constructed by joining namespace and object names with hyphens. Differen...

CVE-2024-14041

A flaw was found in Bouncy Castle for Java, affecting ML-KEM CRYSTALS-Kyber routines. Specifically, the Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines, which handle secret-derived polynomial coefficients, perform division by the modulus q. A remote attacker can exploit this...

Linux Distros Unpatched Vulnerability : CVE-2026-17510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute...

UBUNTU-CVE-2026-13505

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-13505

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

JLSEC-2026-1222 When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the ...

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for th...

CVE-2026-48007 Element Call reports full URLs of visited pages to analytics server

Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a posthog key in config.json or by the posthogApiHost and posthogApiKey URL parameters. Several fields of this data $initialpersoninfo,...

UBUNTU-CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...