59501 matches found
Use of Password Hash With Insufficient Computational Effort
Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...
CVE-2026-14316 Heap buffer overflow in boks_sshd revoked-key error handling
The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...
CVE-2026-14316 Heap buffer overflow in boks_sshd revoked-key error handling
The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...
CVE-2026-14316
The boks_sshd software contains a heap buffer overflow vulnerability within its revoked-key error handling path. The root cause is the use of sprintf() to construct a human-readable failure reason into a heap buffer that is insufficiently sized for the final formatted message. This results in dat...
EUVD-2026-90905
The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...
Use of Password Hash With Insufficient Computational Effort
Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...
Improper Verification of Cryptographic Signature
Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...
GHSA-4Q55-J62X-FR9H devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a proto own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works,...
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a proto own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works,...
NPM: devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
NPM: devalue: Malformed null-prototype object keys bypass proto rejection via property-key coercion vulnerability discovered by ? in WordPress Npm devalue versions = 5.9.2...
CVE-2026-103004
Next.js versions from 16.3.0 to 16.3.7 warm "use cache" handlers using "next/root-params" and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root para...
Security Bulletin: IBM webMethods Integration Sever is affected by multiple CVEs related to Bouncy Castle for Java FIPS jars
Summary IBM webMethods Integration Sever uses third party Bouncy Castle for Java FIPS jars that are affected by multiple CVEs. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X...
CVE-2026-79899 Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...
CVE-2026-79899 Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...
EUVD-2026-90871
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...
CVE-2026-102382
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0...
github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object
A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...
CVE-2026-62061
The WordPress ProfileGrid plugin (versions
CVE-2026-102382 WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0...