28671 matches found
BIT-MONGODB-2026-13062 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...
CVE-2026-74889: Inadequate Encryption Strength
opensslencrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks...
PT-2026-73381
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...
PT-2026-73388
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...
PT-2026-76612
openssl encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from dict that creates key bundles from untrusted data without verifying signatures. Attackers can call from dict followed by to identity without signature verification to encrypt data using attacker-controlled publi...
The vulnerability of the Apache Tomcat application server, related to the use of cryptographic algorithms containing vulnerabilities, allows attackers to alter the order of preference for encryption.
The vulnerability of the Apache Tomcat application server is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability allows a remote attacker to alter the encryption preferences...
CVE-2026-19891
A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...
CVE-2026-19891
CVE-2026-19891 affects TRENDnet TEW-WLC100 firmware (version 2.05b02) and involves an issue in the IKE Phase 1 Aggressive Mode component, specifically the /etc/racoon.conf function. The attacker can remotely manipulate the exchange_mode argument, resulting in missing encryption of sensitive data....
EUVD-2026-59607
A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...
CVE-2026-19891 TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryption
A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...
PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext
...
CVE-2026-19891: Missing Encryption of Sensitive Data
A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...
PT-2026-72886
Name of the Vulnerable Software and Affected Versions TRENDnet TEW-WLC100 version 2.05b02 Description An issue exists in the IKE Phase 1 Aggressive Mode component within the /etc/racoon.conf file. Manipulation of the exchange mode argument leads to a failure in encrypting sensitive data. This fla...
GO-2026-5426 vulnerabilities
Vulnerabilities for packages: grafana-mimir, rabbitmq-messaging-topology-operator, terraform-provider-grafana, step-issuer, newrelic-infrastructure-agent, kwok, flyte, haproxy-ingress, crossplane-provider-azure-sql, migrate, kapp, falcosidekick, ratify, sftpgo, tfsec, rabbitmq-cluster-operator,...
GO-2024-2824 vulnerabilities
Vulnerabilities for packages: hello-world-golang, neuvector-scanner, ghaudit, docker-credential-gcr, kwok, flyte, runc, tfsec, helm, falcosidekick, stern, kpt, sonobuoy, gitness, harbor-scanner-trivy, gke-gcloud-auth-plugin, cfssl, libnvidia-container, overmind, cert-manager-webhook-pdns, guac,...
Malicious code in webautomation_js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5 index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a...
CVE-2026-65934
An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below...
CVE-2026-19293
SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...
CVE-2026-65934
CVE-2026-65934 affects the BT122 module; an unencrypted “pause encryption request” message can cause a denial of service. The vulnerability is described in multiple sources (NVD/CVE records and CVE history) with a CVSSv4 base score of 7.1 (HIGH) and an adjacent ATT&CK-like risk under the vulnerab...
