Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fixed a memory leak in seg6hmacinitalgo. seg6hmacinitalgo returns without cleaning up previously allocated memory. If this happens, all that memory will be leaked, potentially causing issues with crypto-related function...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realized through netlink using four attributes:...

CVE-2026-57122: Insufficient Verification of Data Authenticity

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

CVE-2026-70658: Observable Timing Discrepancy

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

PT-2026-91283

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalid signature? in app/controllers/pay/webhooks/paddle billing controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

Linux Distros Unpatched Vulnerability : CVE-2026-72709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to...

FreeBSD : cjose -- Use of Hard-coded Cryptographic Key (3a38fdda-b05a-11f1-9369-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3a38fdda-b05a-11f1-9369-b42e991fc52e advisory. https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq reports: OpenIDC/cjose is a C...

CVE-2026-72709

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

UBUNTU-CVE-2026-72709

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

CVE-2026-72709

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

CVE-2026-72709 SPIP < 4.4.18 Missing Authorization via ecrire/action/

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

EUVD-2026-76155

SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser. Attacker...

CVE-2026-72709

SPIP before 4.4.18 is affected by a missing authorization vulnerability in the administrative action endpoints under ecrire/action/. The root cause is the absence of a server-side permission check via autoriser(): an unauthenticated attacker can obtain a valid HMAC-SHA256 nonce, compute it for an...

Exploit for CVE-2026-81861

SCADAPack Secure Lock fixture verifier This repository is a d...

PT-2026-89912

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description An authorization flaw exists in sensitive actions located under the 'ecrire/action/' endpoint. Unauthenticated attackers can invoke privileged actions by providing a valid CSRF Cross-Site Request Forge...

Fedora 45 : perl-Net-OAuth (2026-27bab0e213)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-27bab0e213 advisory. Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non- constant-time comparison in verify. This update...

SUSE CVE-2026-53939

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...

Linux Distros Unpatched Vulnerability : CVE-2026-53939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using ...

CVE-2026-87929

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87929 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...