CVE-2026-67596: Weak Encoding for Password

CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can...

Skillsets on the Chain: A Blockchain-Based Zero-Trust Framework for Agentic AI Networking

Agentic AI networking AgentNet systems rely heavily on third-party skillset implementations and distributed multi-agent collaboration, yet they face major claim-to-capability inconsistencies and security vulnerabilities under trust-by-declaration assumptions. To bridge this gap, this paper propos...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 Failing Open Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Robust Auto-Update Controller. The issue results fro...

Apple accused of letting fake crypto app steal $1.8 million

Apple's tagline for its App Store says, "The apps you love. From a place you can trust." You might love the apps, but can you trust the store? A federal lawsuit filed in the Northern District of California last week suggests not. Three people have accused Apple of promoting a fake version of the...

Why Authentication UX Deserves More Attention on B2B Platforms

Better authentication UX helps B2B platforms reduce security fatigue, simplify account recovery, protect sensitive data, and keep business users engaged...

CVE-2026-16751

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

CVE-2026-16751 Ente Museum Server Authorization Bypass Vulnerability

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

CVE-2026-16751 Ente Museum Server Authorization Bypass Vulnerability

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

CVE-2026-16751

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

CVE-2026-16751 Ente Museum Server Authorization Bypass Vulnerability

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

EUVD-2026-50323

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

CVE-2026-16751

The Ente Museum Server by Ente Technologies is vulnerable to an authorization bypass in its emergency recovery approval component. An authenticated attacker, configured as a victim's emergency contact, can bypass the configured recovery waiting period to take over a victim's account by sending a ...

CVE-2026-16751: Undefined Security Weakness

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

PT-2026-65794

Name of the Vulnerable Software and Affected Versions Ente Museum Server affected versions not specified Description An authorization bypass exists in the emergency recovery approval component. An authenticated attacker who is designated as a victim's emergency contact can bypass the established...

Esri Portal for ArcGIS < Security 2026 Update 2 Multiple Vulnerabilities

The version of Esri Portal for ArcGIS installed on the remote host is missing Security 2026 Update 2 Patch. It is, therefore, affected by multiple vulnerabilities: - A missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API...

PT-2026-69191

This update for rsyslog fixes the following issue - input sequence during oversize-frame recovery in imptcp can cause denial of service bsc1271910...

NewStart CGSL MAIN 6.06 : ipv6nat-selinux Multiple Vulnerabilities (NS-SA-2026-0054)

The remote NewStart CGSL host, running version MAIN 6.06, has ipv6nat-selinux packages installed that are affected by multiple vulnerabilities: - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This...

Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack

Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for an attack on seven-round AES-128. The HAWK attack exploits a previously unused symmetry in the lattice behind the signature scheme. Anthropic's released...

CVE-2026-66751

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-66751 Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...