GO-2026-6132 goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) in goshs.de/goshs

goshs SFTP authentication bypass via empty password incomplete fix of CVE-2026-40884 in goshs.de/goshs...

CVE-2026-75106

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

CVE-2026-75106 OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

CVE-2026-75106 OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

CVE-2026-75106 OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

ANT-2026-T6EKK5DB · openssh · heap-buffer-overflow (READ of size 1, 1 byte before allocation)

heap-buffer-overflow low Severity Claude critical · Security research firm low · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-T6EKK5DB: heap-buffer-overflow READ of size 1, 1 byte...

MINI-9V2H-MMQW-97R6

Bulletin has no description...

MINI-F69V-865C-PX23

Bulletin has no description...

openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

A flaw was found in OpenSSL. The implementations of AES-SIV Advanced Encryption Standard - SIV and AES-GCM-SIV Advanced Encryption Standard - Galois/Counter Mode - SIV incorrectly process authentication tags for empty messages. This vulnerability allows a remote attacker to forge empty messages...

openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()

A flaw in OpenSSL causes EVPCipher to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid...

PT-2026-76801

Name of the Vulnerable Software and Affected Versions OpnForm affected versions not specified Description The software derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt. This allows unauthenticated attackers to compute hashes for any...

MINI-H6P7-592M-G7X9

Bulletin has no description...

MINI-XHPF-5HGF-W2FR

Bulletin has no description...

MINI-MC8F-F9RM-R7M2

Bulletin has no description...

CVE-2026-74429

CVE-2026-74429 describes a Linux kernel issue in rxrpc where a reply DATA packet can be received before the client has sent any request DATA packets, potentially causing an oops in rxrpc_rotate_tx_window. The fix updates rxrpc_receiving_reply() to detect an apparent reply before exposure of the c...

CVE-2026-72330 net/tls: Consume empty data records in tls_sw_read_sock()

In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tlsswreadsock A peer may send a zero-length TLS applicationdata record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption such a...

DTLS server cookie bypass during startup window due to empty initial cookie secret

...

CVE-2026-17186

creationtimestamp| type| source ---|---|--- 2026-08-14 20:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt2y7wfw4m2t 2026-08-14 21:10:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eam25mpy65fsm 2026-08-15 01:30:25+00:00| seen|...

CGA-84CC-XGCW-2P2M

Bulletin has no description...

CVE-2026-72813

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...