CVE-2026-82827 A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82827

The Hitachi Coding Software Suite (versions through 3.3.0 ) is vulnerable to a Use of Hard-coded Cryptographic Key flaw. The software uses a hard-coded JWT signing secret key , which enables an attacker to generate unauthorized Bearer tokens . By using these fraudulent tokens, an attacker can exp...

EUVD-2026-90492

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

Exploit for CVE-2026-96349

CVE-2026-96349 — WordPress SiteSkite ≤ 2.1.8 → unauthenticated...

CLEANSTART-2024-TG46953 Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1

Security vulnerability affects the krb5 package. The Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1...

CLEANSTART-2026-TP37792 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

CVE-2026-32283 affects multiple packages. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. See references for individual vulnerability details...

CLEANSTART-2026-GK62523 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CLEANSTART-2026-UN16903 Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly

Security vulnerability affects the apache-nifi package. The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly...

CLEANSTART-2026-GM89854 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

Security vulnerability affects the kube-state-metrics-fips package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...

CLEANSTART-2026-HN45424 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh

Security vulnerability affects the kube-state-metrics-fips package. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh...

CLEANSTART-2026-LM88265 RSA and DSA public key parsers did not enforce size limits on key parameters

Security vulnerability affects the kube-state-metrics-fips package. The RSA and DSA public key parsers did not enforce size limits on key parameters...

PT-2026-103883

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS tmp may be able to obtain CA secret or host private-key...

PT-2026-105167

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add binding/3 parses the routing key as an integer weight N and computes ring positions with lists:seqNextN0, NextN0 + N - 1. validate binding/2 only checks N = 1 , no upper bound. The...

CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1789899690)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1789899690 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

Rocky Linux 8 [CIQ] Security Update: munge / munge-debuginfo / munge-debugsource / munge-devel / etc (crlsa-2026_3032)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20263032 advisory. MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery CVE-2026-25506 Tenable has extracted the preceding description blo...

PT-2026-105922

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLC KEY or --key without also pinning the URL...

PT-2026-105830

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user api key auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

Learnt Attacks on Quantum Key Distribution under Channel Noise and Device Drift

Quantum key distribution QKD links are provisioned from security analyses of stationary channels, whereas the devices that determine the channel drift between recalibrations. Whether an eavesdropper who cannot alter the channel's own noise gains by following that drift has not been quantified...

Rocky Linux 9 [CIQ] Security Update: coreutils / coreutils-common / coreutils-debuginfo / etc (crlsa-2026_28911)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202628911 advisory. coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 Tenable has extracted the preceding description block directly from the...

PT-2026-103708

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...