PT-2026-5730

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint...

security-code-analyzer

security-code-analyzer An...

Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

Summary The NativeAuthenticationStrategy.authenticate method is vulnerable to a timing attack that allows attackers to enumerate valid usernames email addresses. Details In packages/core/src/config/auth/native-authentication-strategy.ts, the authenticate method returns immediately if a user is no...

CVE-2025-69929

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format...

CVE-2025-69929

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format...

CVE-2025-69929

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format...

CVE-2025-69929

The N3uron Web User Interface (version 1.21.7-240207.1047 ) is vulnerable to a privilege escalation issue. The root cause is the use of the MD5 algorithm for client-side password hashing over a predictable string format . A remote attacker can exploit this cryptographic weakness to increase permi...

CVE-2025-69929

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format...

CVE-2025-69929

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format...

PT-2026-5335

Name of the Vulnerable Software and Affected Versions N3uron Web User Interface version 1.21.7-240207.1047 Description A flaw exists in the N3uron Web User Interface that permits a remote attacker to gain elevated privileges. This is due to the use of MD5 hashing on the client side with a...

EUVD-2025-206531

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format...

CVE-2025-69929

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format...

CVE-2025-69929: Use of a Broken or Risky Cryptographic Algorithm

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format...

The vulnerability of TP-Link Omada network gateways’ microprogramming software relates to the use of one-way hashing with predictable random data. This allows attackers to gain unauthorized access to confidential information.

The vulnerability of TP-Link Omada network gateways’ microprogramming software is related to the use of one-way hashing with predictable random data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to confidential information...

CVE-2026-22985 idpf: Fix RSS LUT NULL pointer crash on early ethtool operations

In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the interface comes up, causing the following NULL pointer crash when ethtool operations like rxhash on/off are performed befor...

CVE-2025-64097

NervesHub (OTA firmware management service) is affected by CVE-2025-64097 due to tokens used for user/API authentication having a predictable format from 1.0.0 up to 2.3.0. The root cause is insufficient entropy in tokens, allowing brute-forcing to gain unauthorized access to user accounts or API...

Azure Linux 3.0 Security Update: hyperv-daemons (CVE-2019-10638)

The version of hyperv-daemons installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-10638 advisory. - In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the...

PT-2026-3943

Name of the Vulnerable Software and Affected Versions NervesHub versions 1.0.0 through 2.2.9 Description NervesHub is a web service for managing over-the-air OTA firmware updates. A weakness existed where attackers could potentially compromise user API tokens due to their predictable format. Thes...

File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login

Summary The JSONAuth.Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuring the response time of the /api/login endpoint. Details The vulnerability exists due to a "short-circuit" evaluation in the authentication logic. When a username ...

MiracleLinux 7 : unbound-1.6.6-5.0.3.el7.AXS7 (AXSA:2024-8987:07)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8987:07 advisory. CVE-2023-50868: avoid availabiluty of the remote attackers to cause a denial of service using DNSSEC CVE-2023-50868 The Closest Encloser Proof aspect of the...