secureCodingDemo

secureCodingDemo 2022年秋季 安全编码 CVE-2019-13272 : Linux 内核权限管理不当漏洞 Georgette Kendall CSEC 302 2022年11月14日，星期一 链接包含在 .txt 文件中...

PT-2026-89020

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

EUVD-2026-72013

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...

EUVD-2026-71855

The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing...

Chromium: CVE-2026-79084 Inadequate encryption strength in Notifications

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-64896

Johnson Controls T2000 (before 31.6 ) is affected by a Debug and Test Interface with Improper Access Control vulnerability, described as an open debug port that allows an attacker to access functionality not properly constrained by ACLs. The CNA-assigned CVSS 4.0 score is 5.2 (MEDIUM) with a phys...

CVE-2026-64896 T2000 open debug port

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6...

EUVD-2026-67003

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

Linux Distros Unpatched Vulnerability : CVE-2026-79084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to...

DEBIAN-CVE-2026-79084

Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79084

Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79084

Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79084

Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79084

CVE-2026-79084 is an inadequate encryption strength flaw in the Notifications component of Google Chrome on Windows , affecting versions prior to 152.0.7977.65 . A remote attacker leveraging social engineering can bypass the web origin policy via a crafted HTML page. The CVSS 3.1 score is 4.3 (Me...

gstreamer-plugins-good: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing

A flaw was found in GStreamer. This vulnerability, a heap-based buffer overflow during PNG file parsing, allows a remote attacker to execute arbitrary code. Successful exploitation requires user interaction, such as opening a malicious PNG file or visiting a specially crafted web page. The issue...

CVE-2026-5093

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

Active Directory Security Feature Bypass Vulnerability

Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network...

PT-2026-70672

Name of the Vulnerable Software and Affected Versions Windows Active Directory affected versions not specified Description Inadequate encryption strength allows an authorized attacker to bypass a security feature over a network, which can lead to an impact on the system. Recommendations At the...

Why Generative AI Needs a New Kind of Security

This is Post 2 of a three-part series. Start withPost 1: Agentic AI Security: The Chatbot Era Is Over, then continue to Post 3: OWASP LLM Top 10: What Comes Next – Agentic & MCP. There is a moment every CISO is having right now, often without warning. A developer shows a working internal demo of ...

Inadequate Encryption Strength

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Inadequate Encryption Strength in the BcKeyStoreSpi.engineLoad method, which for legacy BKS keystore versions 0 and 1 passes hMac.getMacSize 20...