CVE-2026-5846 Hard-coded Cryptographic Key in Watchfire Controllers

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the...

CVE-2026-5846

The CVE-2026-5846 entry concerns Watchfire Controller Software, where self-signed hard-coded RSA private keys and X.509 certificates are embedded in plaintext in the firmware patch binaries from Watchfire’s Remote Support filestore. This exposes TLS/HTTPS authentication and encryption for the con...

CVE-2026-5846

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the...

CVE-2026-5846 Hard-coded Cryptographic Key in Watchfire Controllers

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the...

CVE-2026-67529 OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/timeentries and GET /api/v3/costentries rendered links.workPackage.title and links.workPackage.href through associatedresource in modules/costs/lib/api/v3/timeentries/timeentryrepresenter.rb and...

CVE-2026-67527 OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

CVE-2026-15977 CVE-2026-15977

SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...

EUVD-2026-51265

SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...

CVE-2026-14227 Insufficient session expiration in MikroTik RouterOS

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an...

SUSE CVE-2026-17819

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17822

Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17839

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17841

Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

MGASA-2026-0308 Updated perl-DBI packages fix security vulnerabilities

The updated packages fix several security issues...

SUSE CVE-2026-17936

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-18013

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-22555

Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets...

CVE-2025-0152

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended...

EUVD-2025-210544

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended...