1648 matches found
EUVD-2026-93017
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials an...
CVE-2026-94299: Incorrect Authorization
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...
CVE-2026-85153: Use of Hard-coded Cryptographic Key
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials an...
PT-2026-106341
Name of the Vulnerable Software and Affected Versions elegro Crypto Payment versions prior to 1.0.2 Description The plugin fails to require a shared secret before trusting incoming payment notification requests. This allows unauthenticated attackers to forge payment confirmations and change the...
PT-2026-106364
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials an...
CLSA-2026-1791028051 TuxCare security update for node-forge (3 CVEs)
TuxCare rebuilt node-forge to address 3 CVEs. Fixed in 1.3.1-tuxcare.1...
CVE-2026-16001
The Bouncy Castle Inc. bc-csharp library (versions before 2.7.0 ) is vulnerable to a message authentication key exposure in the IesEngine stream mode. Specifically, when an IesEngine is constructed without a block cipher, the MAC key is taken from the key derivation output immediately following a...
Hardcoded Symmetric Key in Brocade ASCG (CVE-2026-85422)
A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored managemen...
Security Bulletin: Multiple vulnerabilites in IBM Rational Build Forge.
Summary IBM Rational Build Forge 8.1.0.0 addresses multiple vulnerabilites Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for comma-separated values when comma: true is enabled, allowing attackers to cause denial-of-service via...
Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.
Summary IBM Maximo Application Suite - IoT Component uses perl 0:5.32.1-481.1.el96, GO-2026-6061- go - google.golang.org/grpc/internal/transport :v1.82.0, nodejs - tar:7.5.19, bind 32:9.16.23-40.el98.2, cryptography 46.0.7, libarchive 3.5.3-9.el97 which is vulnerable to CVE-2023-47038,...
CVE-2026-93580
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...
Improper Validation Of Nested Digest Algorithm Sequence Elements
node-forge is vulnerable to improper validation of nested DigestAlgorithm sequence elements. The vulnerability is due to insufficient validation of element counts in the DigestAlgorithm sequence, which allows an attacker to insert garbage bytes and forge valid signatures for arbitrary messages wh...
AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787734642)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787734642 advisory. - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN...
CLEANSTART-2026-ZJ53876 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...
CLEANSTART-2026-ER79648 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...
CLEANSTART-2026-NK73842 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...
CLEANSTART-2026-MW03453 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...
PT-2026-108594
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...