CVE-2026-82641

Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt...

CVE-2026-82641

Keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all network interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. An unauthenticated attacker on the network can retrieve NSS keylog lines via /agent/pcap/keylog and dec...

PT-2026-83561

keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS...

CLSA-2026-1787999580 openssl: Fix of 2 CVEs

CVE-2026-42766: fix NULL pointer dereference during password-based CMS decryption when the optional keyDerivationAlgorithm field is absent - CVE-2026-34180: fix heap buffer over-read caused by integer truncation of ASN.1 primitive content lengths above 2 GB on 64-bit platforms...

Malicious code in supersignaturenature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1df02839294b29ff278b7a80505be50de75eb0f317f4bf29635236a75e4b15 The published dist/ bundles main/module/browser entrypoints contain code absent from the src/ tree: at library load they read an encrypted rsaToken...

MAL-2026-15560 Malicious code in supersignaturenature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1df02839294b29ff278b7a80505be50de75eb0f317f4bf29635236a75e4b15 The published dist/ bundles main/module/browser entrypoints contain code absent from the src/ tree: at library load they read an encrypted rsaToken...

MAL-2026-15559 Malicious code in secretkey2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1da4c2863f6f6fb95a1ab802243bfde5e04a71e4aa6f0b41f940502d58f501a Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook node lib/core.js that runs a Windows...

EUVD-2025-210808

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2025-36271

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2025-36271 IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2025-36271

IBM Integrated Analytics System (IIAS) versions 1.0.0.0 through 1.0.31.0 are affected by a predictable salt vulnerability in the Magneto component (specifically the resmgr.py module). The use of a predictable salt in cryptographic operations (classified as CWE-759 ) weakens hashing and encryption...

CVE-2025-36271 IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

SUSE CVE-2026-63072

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a...

CVE-2025-36271: Use of a One-Way Hash without a Salt

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

PT-2026-83319

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CLSA-2026-1787848037 openssl: Fix of 2 CVEs

CVE-2026-42766: fix NULL pointer dereference during password-based CMS decryption when the optional keyDerivationAlgorithm field is absent - CVE-2026-34180: fix heap buffer over-read caused by integer truncation of ASN.1 primitive content lengths above 2 GB on 64-bit platforms...

CVE-2026-69247

A flaw was found in cryptography, a Python package for cryptographic primitives. This vulnerability, known as a Bleichenbacher oracle, arises during PKCS7 EnvelopedData decryption. An attacker can exploit distinguishable error messages and timing differences during decryption to gain information...

CLSA-2026-1787843511 openssl: Fix of 2 CVEs

CVE-2026-42766: fix NULL pointer dereference during password-based CMS decryption when the optional keyDerivationAlgorithm field is absent - CVE-2026-34180: fix heap buffer over-read caused by integer truncation of ASN.1 primitive content lengths above 2 GB on 64-bit platforms...

CVE-2026-12802

A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to compromise the integrity of data during the decryption of Cryptographic Message Syntax CMS AuthEnvelopedData. The software fails to properly enforce the tag-length, which could enable an attacker to...

CVE-2026-80522

A flaw was found in the Linux kernel's Tegra cryptography module. An incorrect calculation in the 'tegragcmdoonereq' function, specifically when handling the 'cryptlen' parameter, can occur if a caller does not properly initialize the authentication size. This can lead to a write beyond the...