CVE-2026-104201

GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption...

PT-2026-104062

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An API key is hardcoded and retrievable from the application package. Because Android applications can be reverse engineered, embedding sensitive API credential...

PT-2026-104184

Name of the Vulnerable Software and Affected Versions WP Statistics versions prior to 14.16.15 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the REQUEST URI query-parameter key, enabling t...

PT-2026-104155

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description NTRU secret values are reduced using the % operator in three helper functions, which deviates from the division-free reference implementations. This results in integer divisions where...

CVE-2026-18036: Observable Timing Discrepancy

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

Quantum Key Distribution with Entanglement-Swapped Photons from a Quantum Emitter

Quantum key distribution QKD is a fundamental functionality of quantum networks. Extending its range requires quantum repeaters, a technology still under development and not yet demonstrated in combination with quantum cryptographic protocols. Here, we address the elementary operation of a viable...

PT-2026-104107

Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...

PT-2026-104436

Name of the Vulnerable Software and Affected Versions Armatura One affected versions not specified Description Armatura One stores database and message-broker credentials in an installation configuration file. When protection is enabled, these credentials are encrypted using AES-128-CBC Advanced...

ManageEngine Applications Manager < Build 182100 Multiple Vulnerabilities

According to its self-reported version number, the instance of ManageEngine Applications Manager running on the remote host is build 182000 or below and is not one of the fixed builds 181104 to 181109, 182001 to 182009. It is, therefore, affected by multiple vulnerabilities: - ZohoCorp ManageEngi...

Linux Distros Unpatched Vulnerability : CVE-2026-104201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - radsecproxy - None Ubuntu Linux - GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption CVE-2026-104201 Note that Nessus relies o...

Hardcoded Symmetric Key in Brocade ASCG (CVE-2026-85422)

A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored managemen...

Hardcoded JSON Web Tokens (JWT) in Brocade ASCG before 3.5.0 (CVE-2026-87424)

A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key...

CVE-2026-71449

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-71449

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-71449

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-71449

The Johnson Controls EasyIO FS32 software contains a Use of Hard-coded Cryptographic Key vulnerability (CWE-321) affecting versions prior to 3.0b63 . The flaw stems from the use of a fixed secret key for encryption or decryption processes, which enables an attacker to retrieve embedded sensitive ...

GO-2026-6586 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go...

russh: russh: Cryptographic fallback bypass via missing public key validation

A flaw was found in russh. The library fails to validate peer public keys during hybrid cryptographic key exchange, accepting an all-zero key. A remote attacker acting as a malicious Secure Shell SSH peer can exploit this flaw during connection negotiation to force the classical encryption...

russh: russh: Denial of Service via unbounded memory exhaustion during stalled key renegotiation

A flaw was found in russh. An authenticated remote attacker can cause a Denial of Service DoS by initiating a Secure Shell SSH key renegotiation without completing it and flooding the server with channel open requests. Because the server continues buffering incoming requests without draining the...

CVE-2026-14316

The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...