CVE-2026-54887

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl DTLS server allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtlsserverconnection:initialhello/3 initializes previouscookiesecret to the empty...

EEF-CVE-2026-54887 DTLS server cookie bypass during startup window due to empty initial cookie secret

Summary Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl DTLS server allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls\server\connection:initial\hello/3 initializes previous\cookie\secret...

CVE-2026-54887 DTLS server cookie bypass during startup window due to empty initial cookie secret

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl DTLS server allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtlsserverconnection:initialhello/3 initializes previouscookiesecret to the empty...

CVE-2026-54887

CVE-2026-54887 concerns Erlang/OTP's DTLS server in ssl, where during startup the cookie secret is initialized to an empty binary instead of a random value. This makes DTLS cookie computation deterministic for the first 0–15 seconds, allowing an observer of plaintext ClientHello to forge a valid ...

PYSEC-2026-646 OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

The ironic-api service in OpenStack Ironic before 4.2.5 Liberty and 5.x before 5.1.2 Mitaka allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the...

PYSEC-2026-753 Exposure of Sensitive Information to an Unauthorized Actor in OpenStack tripleo-heat-templates

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the wwwauthenticateuri parameter which is visible to all end users in configuration files. This would give sensitive...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the BalancerForward process. An attacker can manipulate upstream IP-based logic, such as rate limiting, access control, and audit logging, by injecting a spoofed X-Real-IP header value in requests. Remediation The...

GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

Summary The BalancerForward proxy helper in GoFiber uses Header.Add instead of Header.Set when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header nginx,...

CVE-2026-57766

creationtimestamp| type| source ---|---|--- 2026-07-02 12:25:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpnzoc75jf2l 2026-07-02 16:01:25+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpofpsgu4w2b 2026-07-03 03:53:39+00:00| seen|...

DEBIAN-CVE-2026-11946

An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string up to 4.09 GB via the UInt32 length field delivered acros...

CVE-2026-57762

creationtimestamp| type| source ---|---|--- 2026-07-02 11:56:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpnxz3twfs2o 2026-07-02 16:02:49+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpofscccbl2m 2026-07-03 00:45:10+00:00| seen|...

hsr: Remove WARN_ONCE() in hsr_addr_is_self().

...

CVE-2026-12891

creationtimestamp| type| source ---|---|--- 2026-07-02 05:58:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpndz4av2p2d...

CVE-2026-57276

creationtimestamp| type| source ---|---|--- 2026-07-02 04:27:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpn6xrhrlv2z 2026-07-02 18:42:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoopognri2b 2026-07-03 07:51:31+00:00| seen|...

CVE-2026-57278

GeoWebPlayer also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud is an addon that can be installed with various GeoVision software GV-VMS, GV-Cloud, .... It creates a websocket server that expands the capabilities of the various web-interfaces provided by the...

Linux Distros Unpatched Vulnerability : CVE-2026-57962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied...

PT-2026-55479

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0 Description An address normalization mismatch between the handshake path and the mempool misbehavior path allows an unauthenticated IPv4 peer to deterministically crash a synced Zebra node. This occurs when a node...

PT-2026-55465

Name of the Vulnerable Software and Affected Versions SpecifyJS versions prior to 0.2.136 Description In the assertSecureUrl function, a parse error triggered by new URL caused the function to return without throwing an exception. This behavior allowed requests to proceed without the required HTT...

Linux Distros Unpatched Vulnerability : CVE-2026-53353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hsr: Remove WARNONCE in hsraddrisself. syzbot reported the warning 0 in hsraddrisself, whose assumption is simply wrong. hsr-selfnode is cleared in...

PT-2026-55269

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 20.0 through 29.0.2 Erlang/OTP versions 28.0 through 28.5.0.2 Erlang/OTP versions 27.0 through 27.3.4.13 ssl versions 8.2 through 11.7.2 ssl versions 11.6.0 through 11.6.0.2 ssl versions 11.2.0 through 11.2.12.9 Description...