CVE-2026-14507: Out-of-bounds Write

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation...

PT-2026-107860

A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key...

CVE-2026-107675: Key Exchange without Entity Authentication

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-105674: Use of Insufficiently Random Values

TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media...

PT-2026-108131

Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description Docker Sandboxes may fail open when masking credentials in protected proxy responses. This occurs when a response-body read returns data simultaneously with an error, causing affecte...

PT-2026-107853

A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored managemen...

CVE-2026-101998: Not Failing Securely

Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refres...

CVE-2026-67693

A flaw in gnutls v.3.8.13 allows a remote attacker to obtain sensitive information by presenting a specially crafted end-entity X.509 certificate. The vulnerability stems from the software's failure to reject certificates containing contradictory Key Usage (KU) and Extended Key Usage (EKU) extens...

CVE-2026-107565: Improper Validation of Specified Quantity in Input

A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...

CVE-2026-85422: Use of Hard-coded Credentials

A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored managemen...

CVE-2026-106429: Integer Underflow (Wrap or Wraparound)

An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint...

CVE-2026-87676: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsing uploaded X.509 PEM certificates for management display, the system improperly validates the length of the Authority Key Identifier AKI extension before...

CVE-2026-92861: Use of Hard-coded Credentials

The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application...

WS-2026-0144

@payloadcms/plugin-mcp 3.64.0 through 3.87.1 and four 4.0.0-internal builds from May 2026: an operator-precedence bug in the default MCP API-key resolver made it ignore the key passed by a custom overrideAuth function and authenticate with the request's Authorization bearer header instead, so...

PT-2026-108178

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Weak cryptographic protection and a hard-coded recovery key exist within the pkcrypto passkey component. A local attacker can exploit this flaw to recover the root password and obtain root...

cjose security update

0.6.2.2-7.1 - Fix CVE-2026-53938: heap buffer overflow in AES key unwrap Resolves: RHEL-256962...

CVE-2026-67693

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage KU and Extended Key Usage EKU...

Rocky Linux 9 [CIQ] Security Update: rpm-sequoia / rpm-sequoia-debuginfo / rpm-sequoia-devel / etc (crlsa-2026_76733)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202676733 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

Rocky Linux 10.2 [CIQ] Security Update: rust-sequoia-sqv-debugsource / sequoia-sqv / sequoia-sqv-debuginfo (crlsa-2026_76735)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202676735 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

MiracleLinux 9 : rust-rpm-sequoia-1.10.2.1-1.el9_8 (AXSA:2026-1995:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1995:02 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description...