RHEL 10 : rust-sequoia-sq (RHSA-2026:76737)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:76737 advisory. Command-line frontends for Sequoia. Security Fixes: sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion...

PT-2026-107386

Name of the Vulnerable Software and Affected Versions wolfSSH affected versions not specified Description wolfSSH fails to validate that the ECDSA curve identifier in a KEXDH REPLY host key blob matches the algorithm negotiated during key exchange. In the ParseECCPubKey function, the blob's...

PT-2026-107498

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine th...

CVE-2026-34499: Use of Hard-coded Cryptographic Key

Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10...

CVE-2026-16516: Insufficient Verification of Data Authenticity

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

CVE-2026-93026: Missing Authorization

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-107177: Use of Default Cryptographic Key

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine th...

CVE-2026-107219: Uncontrolled Resource Consumption

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...

PT-2026-107434

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

RockyLinux 9 : rust-rpm-sequoia (RLSA-2026:76733)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76733 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

AlmaLinux 10 : rust-sequoia-sqv (ALSA-2026:76735)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:76735 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

PT-2026-107668

Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10...

UBUNTU-CVE-2026-93524

XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read...

PT-2026-115311

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-ssh versions prior to 7.0.0 apache-airflow-providers-sftp versions prior to 7.0.0 Description The SSH provider hook disables SSH host-key verification by default. Unless the host key is configured or no host key check ...

Combining Error Verification and Privacy Amplification in Quantum Key Distribution

Quantum Key Distribution QKD protocols typically involve two separate steps of error-verification and privacy amplification. Both steps involve the application of a hash function sampled from a suitable hash family to classical data. A potentially simpler alternative is to implement a single-step...

CVE-2026-76280: Incorrect Permission Assignment for Critical Resource

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...

RHEL 8 : mod_auth_openidc:2.3 (RHSA-2026:77372)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77372 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Conne...

AlmaLinux 9 : rust-rpm-sequoia (ALSA-2026:76733)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:76733 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

RockyLinux 10 : rust-sequoia-sq (RLSA-2026:76737)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76737 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Unbundle capnproto from...