CVE-2026-83843: Out-of-bounds Read

Out-of-bounds read in Windows Internet Key Exchange IKE Protocol allows an unauthorized attacker to deny service over a network...

CVE-2026-65198: Use of Hard-coded Cryptographic Key

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key recoverable from the open-source build can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build...

CVE-2026-69640: Incorrect Authorization

Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network...

CVE-2026-78632: Incorrect Permission Assignment for Critical Resource

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenSSL vulnerabilities (USN-8678-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8678-1 advisory. It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use...

CVE-2023-54411

The Frappe framework versions prior to 13.32.0 are vulnerable to weak authentication regarding print view access. The root cause is that the print view key can be derived from data exposed through other whitelisted API endpoints. This allows an attacker to generate a valid key to view documents w...

CVE-2023-54411 Frappe before 13.32.0 Weak Authentication via Print View Key

Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions...

CVE-2023-54411 Frappe before 13.32.0 Weak Authentication via Print View Key

Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions...

Updated cjose packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap buffer overflow in AES Key Wrap decryption A128KW/A192KW/A256KW. CVE-2026-53938 All-zero Content Encryption Key used for AES-CBC-HMAC JWE encryption. CVE-2026-53939...

MGASA-2026-0496 Updated cjose packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap buffer overflow in AES Key Wrap decryption A128KW/A192KW/A256KW. CVE-2026-53938 All-zero Content Encryption Key used for AES-CBC-HMAC JWE encryption. CVE-2026-53939...

CVE-2026-84320 Nginx UI: Auto backup name allows path traversal outside validated storage path

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storagepath, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that...

DEBIAN-CVE-2026-109243

FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...

CVE-2026-109250

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collectkeys that allows local attackers to write past the fixed 64-entry keys array during PKCS11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots ...

CVE-2026-85963

Progress MarkLogic Server is affected by a vulnerability in deprecated OpsDirector functionality in versions 12.x before 12.1.0 and 11.x before 11.3.7 . The weakness involves Server-Side Request Forgery (SSRF) and the use of a hard-coded cryptographic key , which could allow an unauthenticated re...

CVE-2026-85963 Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resultin...

CVE-2026-85963 Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resultin...

K000163667: libssh vulnerability CVE-2026-59842

Security Advisory Description A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated...

CVE-2026-109359 Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain...

CVE-2026-109359 Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain...

CVE-2026-109359

Contrast versions 1.8.0 before 1.24.1 are susceptible to an improper verification vulnerability in the Coordinator peer recovery process. The system fails to verify that the serving peer utilizes the same manifest generation, leading to Cross-Manifest Exposure . An attacker with write access to m...