Fedora 44 : ceph (2026-7de7d03796)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7de7d03796 advisory. Ceph 20.2.4 GA CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC...

CVE-2026-53804

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration...

CVE-2026-53804

OTRS Community Edition is affected by an authenticated OS command injection in the PGP encryption module . The root cause is that administrator-supplied configuration values (PGP binary path and command options) are concatenated into a shell command without sanitization , enabling arbitrary comma...

CVE-2025-30156

A flaw was found in the CephX authentication protocol used by Ceph, a distributed storage system. CephX uses AES-128-CBC encryption with a hardcoded initialization vector and no message authentication HMAC, making it vulnerable to the same class of unauthenticated-encryption attacks that...

CVE-2026-77151 lin-snow Ech0 crypto.go MD5Encrypt risky encryption

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an...

CVE-2026-77151 lin-snow Ech0 crypto.go MD5Encrypt risky encryption

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an...

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation...

CVE-2026-53804: Improper Neutralization of Special Elements used in an OS Command

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration...

CVE-2026-4936 Power System Insufficient Entropy

IBM PowerVM Hypervisor Platform KeyStore PKS and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could...

CVE-2026-4936

IBM PowerVM Hypervisor PKS and virtual TPM firmware (FW1110.00–.20, FW1060.00–.71, FW950.00–.H2) use weak persistent storage key seeds (CWE-331), allowing an attacker with service processor or HMC access to derive AES keys. Patch to FW1110.30, FW1060.72/80, or FW950.H3, then run sbmgr -regenerate...

Malicious code in emoji-prints-fancy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163576a0a8b626c88261c8cc54c5049d981015c80145ad36e2710fff5014afbe The package advertises itself as a colorized logger, but dist/index.js requires./logger, which at module load AES-256-CBC-decrypts a hardcoded...

Linux Distros Unpatched Vulnerability : CVE-2026-18687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypte...

SUSE CVE-2026-68148

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Add missing superblock check in findorinsertdirectkey The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies that have FSCRYPTPOLICYFLAGDIRECTKEY. It's just a global table for all...

ANT-2026-6FH6D5TF · supabase/supabase · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-6FH6D5TF: Hardcoded Realtime tenant-credential encryption key with no override In docker/docker-compose.yml the...

External Control of File Name or Path

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Inadequate Encryption Strength

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

CVE-2026-74888

The PHP package openssl_encrypt before 1.4.0 uses a non-standard PBKDF2 construction (iterations=1 per call) that weakens key derivation, enabling attackers to more efficiently crack passwords protecting legacy encrypted files. No in-the-wild exploitation is reported; upgrading to version 1.4.0 i...

CVE-2026-74888 openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation

opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...

CVE-2026-74876 openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

BIT-MONGODB-2026-13069 Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...