CVE-2026-77582: Observable Timing Discrepancy

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and...

Mitigating Front-Running Attacks through Fair and Resilient Transaction Dissemination

In modern blockchains, efficient, fair, and faulttolerant information dissemination is critical for performance and security. Several stages of the transaction lifecycle are affected, from the creation and dissemination of transactions to the dissemination of blocks in the consensus layer. Mempoo...

CVE-2026-54147

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefor...

EUVD-2026-83042

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefor...

CVE-2026-54147 http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefor...

CVE-2025-36076 IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system...

CVE-2025-36076

IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2 are affected by a vulnerability where sensitive information is stored in source code (CWE-540). An authenticated user can access this information, potentially using it in further attacks against the system. The ...

EUVD-2025-210957

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system...

EulerOS Virtualization 2.11.0 : pam (EulerOS-SA-2026-3536)

According to the versions of the pam package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to...

EulerOS Virtualization 2.11.1 : python-virtualenv (EulerOS-SA-2026-3469)

According to the versions of the python-virtualenv packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU...

Experimental Demonstration of Finite-Size General Security Via Discrete-Modulated CVQKD with Real Time Postprocessing

Continuous-variable quantum key distribution CVQKD is compatible with telecommunication infrastructure, but implementing composable security with experimentally practical resources has remained challenging, particularly for discrete-modulated DM protocols. We report the first experimental...

Towards TEE-Certified DP: Verifiable Differentially Private Training on Legacy GPUs

Wide adoption of machine learning has created growing policy and regulatory demand for protecting sensitive training data, with differential privacy DP emerging as a key mechanism. Yet a less-studied problem is how to certify the faithful execution of DP during training: an external verifier shou...

Red-Teaming Auto Mode: Improving Blocking Classifiers against Malign Coding Agents

To keep coding agents from going off the rails, production systems now review each proposed action with a blocking monitor that can reject it before it runs Auto Mode in Claude Code, Guardian in OpenAI's Codex. Prior evaluations of such monitors largely measure robustness to accidental harm or...

CVE-2026-92082

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives

LLM-powered autonomous agents are transforming the penetration testing space with dynamic, multi-step offensive security workflows that require minimal supervision by humans. These agents leverage sophisticated reasoning abilities and external security tools to independently carry out...

CVE-2026-13272

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...

CVE-2026-13272

The software IBM Verify Identity Access and IBM Security Verify Access are vulnerable to a security flaw due to missing origin validation in WebSockets. This vulnerability could allow a remote attacker to perform operations as the victim, potentially facilitating further attacks against the syste...

CVE-2026-13272 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...

Astra Linux – Vulnerability in Firefox and Thunderbird

Keyboard events reference strings like “KeyA” that are located at fixed, known, and widely-distributed addresses. Cache-based timing attacks, such as Prime+Probe, could potentially determine which keys were pressed. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

Astra Linux – Vulnerability in Firefox

We are aware that the exploit code for this vulnerability is publicly available. However, we have no knowledge of any attacks in the wild that exploit this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13...