CVE-2026-16590

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users...

CVE-2026-15147

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

CVE-2026-18654

This CVE (CVE-2026-18654) affects the EMR SSH helper commands in the Amazon AWS CLI. The issue is “Key exchange without entity authentication,” enabling potential MITM attackers to intercept SSH sessions and file transfers when connecting to an EMR cluster endpoint. Affected products are AWS CLI ...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent...

CVE-2026-64389

A flaw was found in the Linux kernel's ksmbd component. A remote attacker could exploit a vulnerability in the NTLMv2 authentication process to modify a session key even when authentication fails. This bypasses security checks and could potentially lead to unauthorized access or session hijacking...

SUSE CVE-2026-64389

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

UBUNTU-CVE-2026-64389

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

CVE-2026-64389

Summary: CVE-2026-64389 affects the Linux kernel KSMD (ksmbd) SMB3 multichannel binding path. The code derives the NTLMv2 session key into sess->sess_key during ksmbd_auth_ntlmv2(), before validating the NTLMv2 response. If authentication fails, the subsequent KEY_XCH step may still use the (p...

CVE-2026-64389 ksmbd: validate NTLMv2 response before updating session key

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

EUVD-2026-48933

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

Linux Distros Unpatched Vulnerability : CVE-2026-64389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2...

CVE-2026-15588

A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input...

CVE-2026-63761 SurrealDB before 3.1.0 Algorithm Downgrade via ES512

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 DEFINE ACCESS ... TYPE JWT ALGORITHM ES512, because the underlying jsonwebtoken crate v10.x has no ES512 variant and the mapping defaults to ES384 without any error, warning...

CVE-2026-16242 Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert and without token-based agent authentication, so client certificates were not validated. A remote attacker who can reach the Konnectivity...

CVE-2026-48489

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied failurepath parameter when failureforward: true was enabled, allowing an unauthenticated...

CVE-2026-48489

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied failurepath parameter when failureforward: true was enabled, allowing an unauthenticated...

PT-2026-59673

Summary The WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Details When submitting invalid credentials to /ui/login, the WebUI responds with different error messages based on th...

CVE-2026-53763 OP-TEE has AES-GCM 32-bit integer overflow in length counters that breaks authentication guarantee

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.0.0 and prior to version 4.11.0, 32-bit integer overflows in OP-TEE core's AES-GCM implementation cause the...

CVE-2026-10054

In affected versions of Eclipse Theia 1.8.1 and later, the browser backend exposes privileged terminal RPC over WebSocket /services/shell-terminal, /services/terminals/:id without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when...

CVE-2026-7838

UltraVNC viewer up to 1.8.2.2 is affected by an integer overflow leading to a heap buffer overflow in the RFB failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte reasonLen field is used as reasonLen+1 in CheckBufferSize(); with unsigned 32-bit operands, reasonLen 0xFFFFFF...