CVE-2026-103098

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

CVE-2026-103096

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CLEANSTART-2026-CT85138 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

Security vulnerability affects the consul package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...

CLEANSTART-2026-NG02064 RSA and DSA public key parsers did not enforce size limits on key parameters

Security vulnerability affects the consul package. The RSA and DSA public key parsers did not enforce size limits on key parameters...

CLEANSTART-2026-DS58516 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

EUVD-2026-91069

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63...

EUVD-2026-91148

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

CVE-2026-103098

The GV-Eye software is vulnerable to sensitive information exposure due to the transmission of a sensitive key within the URL query parameter over an unencrypted HTTP connection. Because the request is sent in plaintext rather than via HTTPS, an attacker capable of monitoring network traffic can ...

CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

CVE-2026-103097 GV-Eye Relay Payment API Key Vulnerability

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103097

The GV-Eye Relay Payment API is vulnerable to an information disclosure flaw where an API key is hardcoded and retrievable from the application package. Because Android applications can be reverse-engineered, an unauthorized user can extract these sensitive credentials from the client application...

CVE-2026-103097 GV-Eye Relay Payment API Key Vulnerability

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

EUVD-2026-91147

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

EUVD-2026-91146

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103096 GV-Eye Hardcoded API Key Vulnerability

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103096

The GV-Eye application is vulnerable to a hardcoded API key issue. Because Android applications can be reverse engineered , an attacker can extract sensitive API credentials directly from the application package. This allows unauthorized users to misuse the key for unintended purposes. No specifi...

CVE-2026-103096 GV-Eye Hardcoded API Key Vulnerability

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

PT-2026-104137

🚨 CVE-2026-63578 Allocation of resources without limits in password-based private-key decryption PbeUtilities.GenerateCipherParameters in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a PKCS8 EncryptedPrivateKeyInfo or...

PT-2026-104124

Memory allocation with excessive size value in the HSS/LMS signature code HssPublicKeyParameters, HssSignature in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service...

ManageEngine Applications Manager < Build 182100 Multiple Vulnerabilities

According to its self-reported version number, the instance of ManageEngine Applications Manager running on the remote host is build 182000 or below and is not one of the fixed builds 181104 to 181109, 182001 to 182009. It is, therefore, affected by multiple vulnerabilities: - ZohoCorp ManageEngi...