EUVD-2026-71228

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery

CVE-2026-11110 – إعادة استخدام Nonce في AES-GCM تؤدي إلى استعادة المفتاح الشفرة البرمجية Python root@kitploit: aesgcmnoncereusesim.py - Simulated encryption oracle with fixed nonce from Crypto.Cipher import AES import os key = os.urandom16 nonce = b'\x00' 12 ALWAYS SAME NONCE def encryptplaintext...

EUVD-2026-70808

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party...

CVE-2026-85432 MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party...

CVE-2018-10933

CVE-2018-10933 - SSH प्रमाणीकरण बाईपास PoC विवरण CVE-2018-10933 libssh के सर्वर-साइड कार्यान्वयन में एक प्रमाणीकरण बाईपास कमजोरी है। यह दोष एक हमलावर को बिना किसी पूर्व प्रमाणीकरण के SSH2MSGUSERAUTHSUCCESS संदेश भेजने की अनुमति देता है, जिससे अनधिकृत पहुँच प्राप्त होती है। प्रभावित सिस्टम एसएसएच...

CVE-2026-76784

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...

CVE-2026-76784 Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...

EUVD-2026-66641

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful...

CVE-2026-76784

Multiple TP-Link Kasa smart home devices are affected by insufficient cryptographic protections in the local device communication protocol. An attacker on an adjacent network can intercept, replay, or forge locally exchanged control messages, leading to unauthorized device control , state manipul...

PT-2026-82235

Name of the Vulnerable Software and Affected Versions TP-Link Kasa affected versions not specified Description Multiple smart home devices have insufficient cryptographic protections in the local device communication protocol. An attacker on the same network can intercept, replay, or forge locall...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the chacha20poly1305cipher and aesocbcipher implementations under providers/implementations/ciphers/. An attacker can forge messages by supplying an empty ciphertext and a bad tag, then...

Exploit for Improper Isolation or Compartmentalization in Mozilla Firefox

CVE-2026-4692 — content processes can declare themselves in RD...

EUVD-2026-63700

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to intercept messages and forge replies due to the exposure of sensitive information...

PT-2026-79164

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to intercept messages and forge replies due to the exposure of sensitive information...

CVE-2026-50577

In ePA 3.x Integration (fbeta-GmbH), request_counter is left unchanged in app/vau/VAUProtokoll.py, causing the server to reuse AES-GCM nonce/key pairs across responses. This enables a network attacker to recover plaintext XORs, exploit the Joux forbidden attack to recover the GHASH key, forge mes...

CVE-2026-53788 rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names...

CVE-2026-53788

CVE-2026-53788 affects rsync prior to 3.5.0. A newline injection in the name-converter uid/gid mapping interface lets local attackers forge protocol messages by embedding newline characters in user/group names, causing the rsync daemon to treat attacker-controlled data as legitimate protocol inpu...

EUVD-2026-58096

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names...

AZL-89808 CVE-2026-45446 affecting package openssl-fips-provider 3.1.2-2

Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional Authenticated Data with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform developed by the American company F5. It integrates functions such as network traffic management, application security management, and load balancing. F5 BIG-IP has a security vulnerability that may allow attackers to forge error messages...