453 matches found
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: fscrypt: stopped using the keyring subsystem for fscryptmasterkey. The approach of having fs/crypto/ manage the fscryptmasterkey structures internally as payloads within “struct key” objects contained in a “struct key” keyring...
CVE-2026-81530 KMS master key exposure via unredacted credential serialization in driver settings string
A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...
CVE-2026-57262
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
EUVD-2026-56013
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks...
CVE-2026-57262: Use of Hard-coded Cryptographic Key
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
CVE-2026-72691
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...
CVE-2026-68148 fscrypt: Add missing superblock check in find_or_insert_direct_key()
In the Linux kernel, the following vulnerability has been resolved: fscrypt: Add missing superblock check in findorinsertdirectkey The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies that have FSCRYPTPOLICYFLAGDIRECTKEY. It's just a global table for all...
CVE-2026-72691
OpenSignLabs opensignserver (up to version 2.37.0) has an authentication bypass vulnerability. An unauthenticated remote attacker can mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl cloud function. The function bypasses its isAuthenticated check when any ...
CVE-2026-72691
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...
EUVD-2026-55531
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...
CVE-2026-72689
OpenSignLabs opensignserver prior to 2.37.0 is affected by a Broken Object-Level Authorization issue. The getDocument Parse cloud function fetches documents using useMasterKey, bypassing object ACLs and returning full contract records, including sender and signer PII and a pre-signed document dow...
EUVD-2026-55521
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...
CVE-2026-72688 OpenSignLabs opensignserver - Missing Authentication for Critical Function
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...
CVE-2026-72688
CVE-2026-72688 concerns OpenSignLabs opensignserver (up to version 2.37.0). The flaw is a missing authentication vulnerability in the fileupload Parse cloud function, which mints MASTER_KEY-signed file access tokens for any caller-supplied URL without session verification. This allows an unauthen...
CVE-2026-72688 OpenSignLabs opensignserver - Missing Authentication for Critical Function
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...
CVE-2026-72688
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...
PT-2026-69832
Name of the Vulnerable Software and Affected Versions opensignserver versions prior to 2.37.1 Description An authentication bypass exists in the getsignedurl Parse cloud function. The function fails to perform the isAuthenticated check when a docId parameter is provided, regardless of whether the...
Google’s synchronized passkeys can be stolen in ‘Pass‑ta‑key’ attacks
Passkeys were supposed to make stolen passwords a thing of the past. No password to phish, no secret to reuse, and no string of characters sitting in a database waiting to be leaked. Over time, it's thought that passkeys will replace passwords entirely. But what happens when malware steals the...
SUSE-SU-2026:3490-1 Security update for wpa_supplicant
This update for wpasupplicant fixes the following issues: - CVE-2025-24912: hostapd RADIUS authentication of wi-fi devices allows a user in between the hostapd and the RADIUS server to inject crafted RADIUS packets and force RADIUS authentications to fail bsc1239461. - Missing network context...