PT-2026-80318

The netty-incubator-codec-ohttp library implements Oblivious HTTP OHTTP gateway and client functionality using Netty's ByteBuf memory management. When an OHTTP gateway processes encrypted client requests, it allocates a pooled direct native off-heap ByteBuf to hold the decrypted plaintext before...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the isSecure function of ServerlessHttpServletRequest due to not verifying the actual scheme. An attacker can potentially access or modify sensitive information by exploiting this improper security che...

PT-2026-79195

Name of the Vulnerable Software and Affected Versions Azure Data Factory affected versions not specified Description Improper verification of cryptographic signatures allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about...

PT-2026-79077

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg tls verify cert san and mg tls verify cert cn functions in...

RHEL 10 : kbd (RHSA-2026:57597)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57597 advisory. The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font...

Linux Distros Unpatched Vulnerability : CVE-2026-11861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for...

RHEL 9 : kbd (RHSA-2026:57610)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57610 advisory. The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font...

Moderate: kbd security update

The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files. Security Fixes: kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-726...

ALSA-2026:57597 Moderate: kbd security update

The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files. Security Fixes: kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-726...

cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization

cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization...

cve-2026-59272 - MEDIUM - Log4j2 AmqpAppender disables TLS hostname verification by default

cve-2026-59272 - MEDIUM - Log4j2 AmqpAppender disables TLS hostname verification by default...

CVE-2026-19505

The RDK-B WebUI (version rdkb-2025q4-kirkstone) is vulnerable to an authentication bypass due to improper cryptographic signature verification in jst_functions.c. The root cause is the incorrect handling of the return value from OpenSSL's EVP_VerifyFinal() function, which treats both valid and in...

CVE-2026-19505 RDK-B WebUI improper cryptographic signature verification vulnerability

Improper cryptographic signature verification in jstfunctions.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature...

Server-Side Request Forgery (SSRF)

magicmirror is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled URLs and authentication parameters in the unauthenticated /calendar Socket.IO namespace, which allows an attacker to make arbitrary server-side requests, bypas...

CVE-2026-54330

A flaw was found in Ceph RGW's SigV4 signature verification handler. When processing S3 requests, RGW verifies only the headers explicitly listed in the X-Amz-SignedHeaders field but does not reject requests that carry additional unsigned x-amz- headers. This diverges from the AWS S3 specificatio...

CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

CVE-2026-73829

ZenHive mpp (Elixir MPP library) versions 0.2.0 through 0.6.0 contain a TOCTOU race condition in the type="hash" credential path of MPP.Methods.Tempo.verify/2. The dedup check-then-mark sequence is non-atomic: check_hash_unused/2 reads the store, an on-chain receipt is verified, and only then doe...

openssl: openssl-src: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking

A flaw was found in OpenSSL. A malicious TLS Transport Layer Security server can exploit this vulnerability by sending a specially crafted OCSP Online Certificate Status Protocol response during the X.509 certificate chain verification process. This can lead to a memory leak in client application...

cve-lab-journal

CVE Lab Journal !CVEs loggedhttps://img.shields.io/badge/C...

CVE-2026-76242

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can...