cryptography

pyca/cryptography .. image:: https://img.shields.io/pypi/v/cryptography.svg :target: https://pypi.org/project/cryptography/ :alt: Latest Version .. image:: https://readthedocs.org/projects/cryptography/badge/?version=latest :target: https://cryptography.io :alt: Latest Docs .. image::...

EUVD-2026-95309

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2026-107829

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2026-107829 Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2026-107829: Use of Password Hash With Insufficient Computational Effort

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2026-93317 Container blob cache can accept unverified content

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...

CentOS Linux 7 [TuxCare] Security Update: squid / squid-migration-script / squid-sysvinit Multiple Vulnerabilities (CENTOS7:CLSA-2026:1786353802)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1786353802 advisory. - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway...

PT-2026-96205

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description The software fails to redact password hashes in the '/user/info' endpoint. This allows authenticated users to retrieve unsalted MD5 password digests for any user by supplying specific user IDs. These...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-82723

AshAuthentication (the Elixir authentication library by team-alembic) stores full actor records—including the hashed_password attribute—into audit log entries via the audit_log add-on's build_extra_data/4 function. The :actor value from the action callback context is deposited verbatim, bypassing...

CVE-2026-82723: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The auditlog add-on builds each entry's extradata in AshAuthentication.AddOn.AuditLog.Auditor.buildextradata/4, which takes...

PT-2026-94295

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.12.0 through 4.14.x ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.1 Description AshAuthentication allows the disclosure of user password digests to readers of the audit store. The audit log add-on builds...

Linux Distros Unpatched Vulnerability : CVE-2026-87962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input due to unvalidated length and capacity fields in MergingDigest.fromBytes in core/src/main/java/com/tdunning/math/stats/MergingDigest.java. An attacker can abort the parsing thread by...

AIDE 0.19.4

AIDE Advanced Intrusion Detection Environment is a free replacement for Tripwiretm. It generates a database that can be used to check the integrity of files on server. It uses regular expressions for determining which files get added to the database. You can use several message digest algorithms ...

CVE-2026-80211

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...

MGASA-2026-0319 Updated squid packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Due to a Improper Validation of Syntactic Correctness of Inputbug, Squid is vulnerable to a Out-of-bounds Read attack against the FTP gateway. CVE-2026-47729 Due to an Improper Input Validation bug, Squid is vulnerable to a Heap-based Buffer...

Updated squid packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Due to a Improper Validation of Syntactic Correctness of Inputbug, Squid is vulnerable to a Out-of-bounds Read attack against the FTP gateway. CVE-2026-47729 Due to an Improper Input Validation bug, Squid is vulnerable to a Heap-based Buffer...

CVE-2026-50012

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling peerDigestSwapInMask in src/peerdigest.cc, Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the masksize declared...

ALPINE-CVE-2026-50012

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling peerDigestSwapInMask in src/peerdigest.cc, Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the masksize declared...