CVE-2025-30239

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...

CVE-2025-30239

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...

CVE-2017-7921-Research-Toolkit GUI

CVE-2017-7921 Research Toolkit Security Statement: This tool is intended for authorized security research and vulnerability verification only. Table of Contents Legal and Ethical Statement Project Description Features Installation Usage Output Defense and Remediation Recommendations Technical...

CVE-2026-19429

Jenkins FilePath.untarFrom does not validate symlink targets when extracting TAR archives, allowing an attacker with Item/Configure permission to create symlinks from a workspace to arbitrary files on the Jenkins controller. This issue remains exploitable in versions patched for CVE-2026-33001 an...

MAL-2026-13518 Malicious code in postcss-theme-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...

CVE-2026-68481 Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

SUSE-SU-2026:23150-1 Security update for bouncycastle

This update for bouncycastle fixes the following issues: Update to 1.85. Security issues fixed: - CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI bsc1272700. - CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check bsc1272701. -...

CVE-2026-68481: Operation on a Resource after Expiration or Release

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

PT-2026-68477

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12 Description In the DefaultEncryptingOAuthDataProvider component, revoked access tokens and refresh tokens can still be decrypted...

CVE-2026-8470

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

CVE-2026-8470

IBM Langflow OSS versions 1.0.0–1.10.3 generate Fernet encryption keys from user secrets using Python’s non-cryptographic random module. The deterministic Mersenne Twister PRNG yields identical keys for identical seeds, enabling an attacker to reproduce encryption keys and decrypt stored API keys...

MAL-2026-12513 Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

MAL-2026-12376 Malicious code in express-middle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567 package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle obfuscator.io-sty...

Malicious code in react-table-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcbd9a8090832d59bcf70ff418611d54c1f558eb0a09927fc13895f5d654f02c package.json declares preinstall: node./dist/index.d.js, disguising an executable loader as a TypeScript declaration file. On npm install, that loade...

MAL-2026-12396 Malicious code in log-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...

MAL-2026-12318 Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

CVE-2026-64566

Consolidated details show CVE-2026-64566 affects the Linux kernel iptfs module. Root cause: when iptfs_skb_add_frags() copies frag references, it increments page refs without propagating SKBFL_SHARED_FRAG to the destination SKB, unlike other frag-transfer helpers. Consequence: if source SKB has s...

SUSE CVE-2026-69247

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summarypkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported theoutcome of decrypting a RecipientInfo's encryptedKey in severaldistinguishable ways, one of which disclosed the exact length recovered from theRSA operation. The same distinction was also observable by timing. Anapplicatio...