CVE-2026-9656

The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wplocalizescript / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with...

PT-2026-60879

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description The software contains hard-coded credentials, such as passwords or cryptographic keys. These credentials are used for inbound authentication, outbound communication with external...

EUVD-2026-44969

The Janssen Project is an open-source identity and access management IAM platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload returns null, and...

CVE-2026-45795

The Janssen Project's Jans-auth-server had a JWE request object signature verification bypass prior to version 2.0.0: unsigned JWE were accepted because JwtAuthorizationRequest skipped inner signature validation when jwe.getSignedJWTPayload() was null, and AuthzRequestService.processRequestObject...

EUVD-2026-44948

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists a...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : .NET vulnerabilities (USN-8553-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8553-1 advisory. Artur Stetsko discovered that the .NET did not properly validate authentication data. An attacker could possibly use this issue t...

CVE-2026-20157

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

USN-8553-1: .NET vulnerabilities

Artur Stetsko discovered that the .NET did not properly validate authentication data. An attacker could possibly use this issue to elevate privileges. CVE-2026-47300 Levi Broderick discovered that .NET did not properly handle XML encryption during parsing. An attacker could possibly use this issu...

USN-8553-1 dotnet8, dotnet10 vulnerabilities

Artur Stetsko discovered that the .NET did not properly validate authentication data. An attacker could possibly use this issue to elevate privileges. CVE-2026-47300 Levi Broderick discovered that .NET did not properly handle XML encryption during parsing. An attacker could possibly use this issu...

EUVD-2026-44718

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20157 Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20157

CVE-2026-20157 is associated with Cisco RoomOS and concerns missing encryption (CWE-311). The NVD entry states a hardening release in Cisco’s security review addresses multiple internally discovered vulnerabilities, with a client-visible impact of potential disclosure of protected information due...

PT-2026-60222

Name of the Vulnerable Software and Affected Versions Cisco RoomOS affected versions not specified Description An internal security review identified issues related to missing encryption, which falls under the Common Weakness Enumeration CWE Pillar CWE-311. Recommendations At the moment, there is...

The vulnerability of the tls_do_encryption function in the net/tls/tls_sw.c component of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the tlsdoencryption function in the net/tls/tlssw.c component of the Linux kernel is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

JLSEC-2026-729 wolfSSL's `wc_PKCS7_DecodeAuthEnvelopedData()` does not properly sanitize the AES-GCM authentication...

wolfSSL's wcPKCS7DecodeAuthEnvelopedData does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-the-middle can therefore truncate the mac field from 16 bytes to 1 byte, reducing the tag check from 2⁻¹²⁸ to 2⁻⁸...

JLSEC-2026-739 AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were...

AES-GCM encryption/decryption with extremely large cumulative single message sizes 64 GiB were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery...

LibreOffice: LibreOffice: Denial of Service via crafted OOXML documents

A flaw was found in LibreOffice. A remote attacker could exploit this out-of-bounds write vulnerability by tricking a user into opening a specially crafted OOXML Office Open XML document with mismatched encryption salt parameters. This could lead to a denial of service DoS, making the application...

CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks

Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from compromised systems. Unlike other information stealers that are built on AppleScript droppers or Objective-C-based wrappers, CrashStealer is implemented in...

openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

SUSE-SU-2026:22647-1 Security update for tomcat10

This update for tomcat10 fixes the following issues Update to Tomcat 10.1.56. Security issues fixed: - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve...