FREEDOM Administration - Default Login

The Web GUI configuration panel of Hirsch formerly Identiv and Viscount Enterphone MESH through 2024 ships with default credentials username freedom, password viscount. The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires ma...

ECOA Building Automation System - Arbitrary File Retrieval

The ECOA BAS controller suffers from an arbitrary file disclosure vulnerability. Using the 'fname' POST parameter in viewlog.jsp, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information. id: CVE-2021-41293 info: name: ECOA Building Automation...

EUVD-2026-62275

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...

CVE-2026-59693

A vulnerability has been identified in Desigo DXR2 All versions V01.21.233.16-7862, Desigo PXC3 All versions V01.21.233.16-7862, Desigo PXC4 All versions V02.21.194.36-2715, Desigo PXC5.E003 All versions V02.21.194.36-2715, Desigo PXC5.E24 All versions V02.21.194.36-2715, Desigo PXC7 All versions...

PT-2026-70191

A vulnerability has been identified in Desigo DXR2 All versions V01.21.233.16-7862, Desigo PXC3 All versions V01.21.233.16-7862, Desigo PXC4 All versions V02.21.194.36-2715, Desigo PXC5.E003 All versions V02.21.194.36-2715, Desigo PXC5.E24 All versions V02.21.194.36-2715, Desigo PXC7 All versions...

Shipping 10–50× More Code? Watch This Webinar on Securing AI-Speed Development

AI is helping development teams produce far more code, far faster. But security teams still have to review vulnerabilities, manage dependencies, prioritize fixes, and control risk at human speed. When software output jumps 10 to 50 times, the problem is no longer just finding vulnerabilities. It ...

CVE-2026-68099

In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on checkaddoverflow to avoid malformed ACL checkaddoverflow unconditionally writes the truncated sum into d even on overflow, per its contract in include/linux/overflow.h. The four checkaddoverflow guards...

osbuild-composer security update

An update is available for osbuild-composer. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A service for building customized OS artifacts, such as VM images a...

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

SummaryWhen resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents...

PYSEC-2026-3553 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the buildchaininner function. An attacker can cause excessive resource consumption by submitting a certificate chain containing duplicate self-signed intermediates, which lead...

MiracleLinux 9 : runc-1.4.2-2.el9_8 (AXSA:2026-1427:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1427:03 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient...

GHSA-JWV3-5HGF-82WW python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents...

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents...

CVE-2026-69249 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an...

EUVD-2026-52450

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an...

CVE-2026-69249

CVE-2026-69249 affects python-cryptography prior to 49.0.0, where resolving invalid certificate chains with duplicate self-signed intermediates can explode in recursion, causing resource exhaustion DoS. The core issue is in the recursive build_chain_inner not de-duplicating previously analyzed ca...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...