OESA-2026-1923 python-jwcrypto security update

Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing...

OESA-2026-1924 python-jwcrypto security update

Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing...

OESA-2026-1925 python-jwcrypto security update

Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing...

OESA-2026-1926 python-jwcrypto security update

Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing...

CVE-2026-5363

Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 uhttpd modules allows Password Recovery Exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login. An adjacent attacker with the ability to...

PT-2026-33500

Name of the Vulnerable Software and Affected Versions Anviz CrossChex Standard affected versions not specified Description An attacker can manipulate the TDS7 PreLogin to disable encryption, which results in database credentials being transmitted in plaintext. This allows for unauthorized access ...

PT-2026-35461

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP...

ROS-20260417-73-0030

A vulnerability in the JOSE implementation of the Authlib library for OAuth and OpenID Connect servers is related to improper integrity value checking. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security mechanisms...

CVE-2026-32650: Selection of Less-Secure Algorithm During Negotiation

Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials to be sent in plaintext and enabling unauthorized database access...

The vulnerability of the Apache Tomcat application server, related to deficiencies in the encryption of confidential data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Apache Tomcat application server is related to deficiencies in the encryption of confidential data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Apache Tomcat 10.1.22 < 10.1.54 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.54. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.54security-10 advisory. - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clusteri...

PT-2026-33487

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6 Description xrdp fails to implement verification for the Message Authentication Code MAC signature of encrypted RDP packets when the Classic RDP Security layer is used. Although signatures are generated by the...

Apache Tomcat 9.0.92 < 9.0.117 Improper Authentication Vulnerability (CVE-2026-34500)

The version of Tomcat installed on the remote host is 9.0.92 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled and...

[SECURITY] Fedora 44 Update: plasma-vault-6.6.4-1.fc44

Plasma Vault allows to lock and encrypt sets of documents and hide them from prying eyes even when the user is logged in...

SUSE CVE-2026-40962

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC Common Encryption subsample data to libavformat/mov.c...

GHSA-M7MQ-85XJ-9X33 Flowise: Weak Default Token Hash Secret

Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Location | packages/server/src/enterprise/utils/tempTokenUtils.ts:31-34 | | Practical Exploitability | Medium | | Developer Approver | [email protected] | Description The encryption key for token encryption has a weak...

Flowise: Weak Default Token Hash Secret

Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Location | packages/server/src/enterprise/utils/tempTokenUtils.ts:31-34 | | Practical Exploitability | Medium | | Developer Approver | [email protected] | Description The encryption key for token encryption has a weak...

Exploit for Missing Encryption of Sensitive Data in Apache Tomcat

CVE-2026-34486-Tribes Apache Tomcat Tribes cluster communicat...

CVE-2026-41015

radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use the latest version from git not a release, the date range for the vulnerable code was less than a week, occurring after 6.1.2 but before 6.1...

CVE-2026-41015

radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use the latest version from git not a release, the date range for the vulnerable code was less than a week, occurring after 6.1.2 but before 6.1...