CVE-2026-83560 New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

CLEANSTART-2026-LW45744 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the minio-operator package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CVE-2026-96347: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...

CVE-2026-103235: Improperly Controlled Modification of Dynamically-Determined Object Attributes

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied...

CVE-2026-103055: Use of Hard-coded Cryptographic Key

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-10764: Use of Hard-coded Cryptographic Key

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data...

CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (CENTOS8.5:CLSA-2026:1773405854)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1773405854 advisory. - When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and...

MiracleLinux 8 : coreutils-8.30-21.el8_10 (AXSA:2026-1940:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1940:06 advisory. coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 Tenable has extracted the preceding description block directly fr...

AlmaLinux 9.2 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl (ALMALINUX9.2:CLSA-2025:1759865335)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1759865335 advisory. - Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation...

AlmaLinux 9.6 [TuxCare] Security Update: containernetworking-plugins Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790783892)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790783892 advisory. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-3381...

Rocky Linux 9.6 [TuxCare] Security Update: gnupg2 / gnupg2-smime (ALMALINUX9.6:CLSA-2026:1780512159)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780512159 advisory. - GnuPG can be made to spin on a relatively small input by for example crafting a public key with thousands of signatures attached,...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789464832)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789464832 advisory. - Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790152441)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790152441 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-3149)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3149 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-425...

CVE-2026-93994: Missing Critical Step in Authentication

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

CVE-2026-77185

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain presumed rare way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform...

Debian dsa-6531 : libcrypto3-udeb - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6531 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6531-1 [email protected] https://www.debian.org/securit...

PT-2026-103121

Name of the Vulnerable Software and Affected Versions Claude Code versions 2.0.68 through 2.1.259 Description Claude Code prioritized a locally stored API key, such as one from a previous /login or configuration file, over a valid Claude Enterprise or Team sign-in when retrieving server-managed...

PT-2026-103194

Name of the Vulnerable Software and Affected Versions SiteSkite versions prior to 2.2.0 Description An unauthenticated remote code execution issue exists due to a critical chain involving API-key autologin and the eval function within the MCP component. This allows an attacker to execute arbitrar...

CVE-2026-103446: Authorization Bypass Through User-Controlled Key

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46...