PT-2026-97528

Name of the Vulnerable Software and Affected Versions Red Hat Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the automation-controller where the log message formatting for API 4XX errors uses an administrator-controlled Python...

Enterprise Access Management EAM does not rotate RSA keys

Overview Imprivata Enterprise Access Management EAM, an authentication and single sign-on platform for enterprise and clinical environments, contains a vulnerability in versions 26.2.6 and below. The product provides no supported mechanism to rotate its RSA key pair after deployment, meaning the...

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

9router treats local loopback requests as trusted and allows access to /v1/ without an API key. In a documented/common reverse-proxy deployment where nginx forwards public traffic to the backend via 127.0.0.1, external non-Origin requests are misclassified as local. This allows unauthenticated...

PT-2026-97490

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

PT-2026-97181

Name of the Vulnerable Software and Affected Versions Post Grid Gutenberg Blocks versions prior to 5.0.41 Description An issue exists where the plugin fails to perform authorization or post-visibility checks on a REST API route. This allows unauthenticated users to disclose the custom field key...

Linux Distros Unpatched Vulnerability : CVE-2026-89422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended...

CVE-2026-84691: Use of Externally-Controlled Format String

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string...

CVE-2026-95602: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

CVE-2026-82356: Inadequate Encryption Strength

Imprivata EAM =26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices...

PT-2026-97350

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A hard-coded cryptographic key in the software allows a remote attacker to bypass authentication and gain access to sensitive information...

CVE-2026-18181: Use of Hard-coded Cryptographic Key

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key...

CVE-2026-18154

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key...

CVE-2026-18154

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to the use of a hard-coded or predictable cryptographic key (CWE-321 ). This flaw could allow a remote attacker to obtain sensitive information. The vulnerability affects FTM versions 4.0.6.0 through 4.0.10.0 (specifically...

CVE-2026-18154 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key...

CVE-2026-18154 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key...

kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report()

A flaw was found in the Linux kernel's Bluetooth Human Interface Device Protocol HIDP. A remote attacker, by sending specially crafted truncated packets from a paired Bluetooth device, could trigger an out-of-bounds read in the hidpinputreport function. This vulnerability may lead to unintended...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The payload does not run at install time, but upon invocation of the package. A language-specific loader then...

Embedded Malicious Code

Overview @memtensor/memos-cloud-openclaw-plugin is an OpenClaw lifecycle plugin for MemOS Cloud add + recall memory Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The...

wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

CVE-2026-94455

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...