4283 matches found
CVE-2026-78234 Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name CN supplied by the author of a namespaced Hawtio custom resource. Because the operator...
CVE-2026-78234
hawtio-operator in OpenShift contains a Service CA signing oracle flaw. The operator reads the Service CA private signing key from the openshift-service-ca namespace and mints client certificates whose Subject CN is taken directly from the author of a namespaced Hawtio custom resource. Because th...
PT-2026-87113
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...
CVE-2026-79575: Use of Insufficiently Random Values
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...
CVE-2026-79575
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...
PT-2026-88458
Name of the Vulnerable Software and Affected Versions Waves Central for macOS versions prior to 17.0 Description A local privilege escalation exists in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality...
CVE-2026-86819: Missing Authorization
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...
CVE-2026-79575
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...
CVE-2026-86408 MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view. The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: type keydata fingerprint but did no...
MAL-2026-16041 Malicious code in wallet-engine-signing (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 448194cce4cee2143b4cfee29a7c171ecab686469ac508f8fb2ad4d2fb67cf67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-86304
MojoX::Authentication for Perl versions prior to 0.006 is vulnerable to a SAML authentication bypass . The parse_assertion function in MojoX::Authentication::Model::SAML2 initializes Net::SAML2::Binding::POST without a trust anchor. When used with Net::SAML2 versions before 0.86 , the signature o...
EUVD-2026-57453
SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers...
GHSA-H4V5-CRX2-3CV4 SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers
CVE: This vulnerability corresponds to CVE-2026-72793. Summary /api/system/getConf is registered with CheckAuth only and is reachable by the publish RoleReader token, and anonymously when Publish.Auth.Enable is false. Its non-administrator masking chain is a blocklist that enumerates fields...
SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
CVE: This vulnerability corresponds to CVE-2026-72794. Summary /api/system/getConf returns Conf.CookieKey, the key used to sign the server's session cookies in its response body. The endpoint is registered with CheckAuth only, so the field reaches the publish RoleReader token and the anonymous...
CVE-2026-75431
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
Exploit for Improper Authentication in Jfrog Artifactory
CVE-2026-82329 Artifactory Security Assessment Tool PoC dan a...
CVE-2026-75431
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
CVE-2026-75431: Use of Hard-coded Cryptographic Key
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
kernel security update
6.12.0-211.51.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...