CVE-2026-85451

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

CVE-2026-18330

A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...

CVE-2026-85451

MOOS core-moos through 10.4.0 is affected by a remote process termination vulnerability in the SuicidalSleeper component. The root cause is a hard-coded passphrase used for multicast command authorization, allowing any multicast-reachable peer to enumerate MOOS processes and send termination comm...

CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

SUSE-SU-2026:23612-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory management in the makepath...

SUSE-SU-2026:23464-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory management in the makepath...

OPENSUSE-SU-2026:21747-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory management in the makepath...

Security update for cpio

This update for cpio fixes the following issues: CVE-2026-66484: path traversal allows creating hard links outside intended directory via malicious tar archives bsc1274856. CVE-2026-66485: denial of service via uncontrolled memory allocation from crafted archives bsc1274857. CVE-2026-66486:...

PT-2026-85378

CVE-2026-82684: Missing authorization in Tycon Systems TPDIN-Monitor-WEB3 ≤2.2.9 lets attackers dump system credentials, configs, or flash contents. CVSS 8.1. Unpatched—assume exposure. Isolate affected units and restrict access https://t.co/MztgdxQJ6F CVE CVEAlert infosec SysAdmin cybersecurity...

CVE-2026-18330: Use of Hard-coded Cryptographic Key

A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...

PT-2026-85379

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device...

PT-2026-85267

A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...

CVE-2026-85451: Use of Hard-coded Credentials

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

PT-2026-85377

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials...

PT-2026-85300

Name of the Vulnerable Software and Affected Versions MOOS core-moos versions prior to 10.4.1 Description The SuicidalSleeper component contains a flaw where a hard-coded passphrase is used for multicast command authorization. A peer with multicast access can enumerate processes and send...

BIT-CEPH-2025-30156 Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

CVE-2026-84798

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...