CVE-2026-73652: Incorrect Authorization

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can chan...

CVE-2026-73576: Use of Predictable Algorithm in Random Number Generator

In Zimbra Collaboration ZCS before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with...

Security Bulletin: IBM® Db2® federated server is affected by vulnerabilities in bcprov-jdk18on-1.82 and bcpkix-jdk18on-1.82.

Summary IBM® Db2® federated server is affected by vulnerabilities in bcprov-jdk18on-1.82 and bcpkix-jdk18on-1.82 Vulnerability Details CVEID:CVE-2026-5588 DESCRIPTION: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all pkix...

Security Bulletin:Vulnerability in paramiko affects IBM Netezza Appliance

Summary The paramiko package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-44405 Vulnerability Details CVEID:CVE-2026-44405 DESCRIPTION: In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm. CWE:CWE-327: Use of a Broken...

CVE-2026-48386

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction...

CVE-2026-48386

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction...

EUVD-2026-56540

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction...

CVE-2026-48386 ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction...

CVE-2026-48386 ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction...

CVE-2026-48386: Use of a Broken or Risky Cryptographic Algorithm

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction...

CVE-2026-68376

The CVE-2026-68376 issue concerns the Linux kernel SCTP implementation. A miscalculated auth_hmacs array size in struct sctp_cookie caused the HMAC-ALGO parameter (struct sctp_paramhdr plus N HMAC identifiers) to overflow the buffer when four identifiers are configured, leading to copying beyond ...

CVE-2026-66411: Incorrect Implementation of Authentication Algorithm

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot...

Security Bulletin:IBM Sterling Global Availability Mailbox uses bcprov-jdk15to18-1.78.1.jar, which is affected by CVE-2025-14813 and CVE-2026-5598, exposing the system to potential security risks including unauthorized access, denial of service.

Summary IBM Sterling Global Availability Mailbox uses bcprov-jdk15to18-1.78.1.jar, which is affected by CVE-2025-14813 and CVE-2026-5598, exposing the system to potential security risks including unauthorized access, denial of service, or remote code execution. Vulnerability Details...

EulerOS 2.0 SP11 : openssh (EulerOS-SA-2026-3085)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithm...

Security Bulletin: Due to the use of Bouncy Castle Inc. BC-JAVA bcprov IBM webMethods Managed File Transfer is vulnerable to a Covert Timing Channel vulnerability and Use of a Broken or Risky Cryptographic Algorithm vulnerability

Summary Bouncy Castle Inc. BC-JAVA bcprov is used by IBM webMethods Managed File Transfer CVE-2025-14813, CVE-2026-5598, CVE-2026-0636 Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JA...

CVE-2026-5430 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this...

CVE-2026-5430 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this...

Security Misconfiguration org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Security Misconfiguration vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1,...

CVE-2026-8470: Use of a Broken or Risky Cryptographic Algorithm

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens

A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...