CVE-2026-84308

phpseclib , a PHP secure communications library, has a non-constant-time X25519 scalar multiplication flaw in versions prior to 3.0.57 and 4.0.1 . The root cause is data-dependent conditional modular reductions in the pure-PHP implementation (Math/PrimeField/Integer.php), which leak per-step timi...

CVE-2026-84308 phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add and subtract. During the Montgomery ladder in...

CVE-2024-7953 DataEdgePlatform DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project...

CVE-2024-7953 DataEdgePlatform DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project...

CVE-2024-7952 DataEdgePlatform DataMosaix™ Private Cloud

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...

CVE-2024-7952 DataEdgePlatform DataMosaix™ Private Cloud

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...

CVE-2024-7952

Rockwell Automation's DataMosaix Private Cloud (versions 7.07 and prior ) is affected by a data exposure vulnerability (CWE-200). Hardcoded links in the source code point to JSON files that are accessible without authentication, allowing an unauthenticated remote attacker to view customer data. T...

SUSE CVE-2026-72180

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

SUSE CVE-2026-72173

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: do not warn on seeing non-migration pmd entry Patch series "mm/hmm: A fix and a selftest", v3. Patch 1 fixes a stale warning present from the time when only migration softleaf entries were supported at the PMD...

PT-2026-84455

Name of the Vulnerable Software and Affected Versions phpseclib versions prior to 3.0.57 phpseclib versions prior to 4.0.1 Description Pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in the add and subtract...

CVE-2026-84308: Observable Timing Discrepancy

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add and subtract. During the Montgomery ladder in...

PT-2026-84540

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 30.0 Description An information disclosure issue exists in the MobileManager plugin. An unauthenticated visitor can send a GET request to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to retrieve...

ASB-A-491253353

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-82725

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

EUVD-2026-68337

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

CVE-2026-82725

CVE-2026-82725 affects ash_phoenix (versions 0.6.0-rc.1 through before 2.3.25 ) in the AshPhoenix.FilterForm component. The root cause is that the form resolved user-supplied relationship paths with Ash.Resource.Info.related/2 , which traverses private relationships, while only checking the termi...

PT-2026-83689

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

CVE-2026-82638

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

CVE-2026-82638 jina-ai reader Server-Side Request Forgery via disabled private-address guard

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

EUVD-2026-68214

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...