CLEANSTART-2026-AZ15466 etcd is a distributed key-value store for the data of a distributed system

Security vulnerability affects the cortex package. etcd is a distributed key-value store for the data of a distributed system...

On the Construction of Trapdoor Claw-Free Functions with Certifiable Key

Trapdoor claw-free functions TCFs underpin much of classical-quantum cryptographic interaction, yet every TCF-based protocol states its guarantees relative to an honestly generated key. We give a family-agnostic abstraction of key certification for noisy TCF constructions, built on two notions: a...

CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

Logic flaw in Brocade SANnav Java cache key handling object comparison handling

A logic flaw in Brocade SANnav Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and...

Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fixes: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 For more details about the security...

PT-2026-96831

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-090091)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090091 advisory. GnuPG 2.2.21 and 2.2.22 and Gpg4win 3.1.12 has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPG...

PT-2026-96690

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 22.2 through 27.3.4.17 Erlang/OTP versions 28.0 through 28.5.0.6 Erlang/OTP versions 29.0 through 29.1.0 ssl versions 9.5 through 11.2.12.12 ssl versions 11.6.0 through 11.6.0.5 ssl versions 11.7.0 through 11.7.6 Descriptio...

CVE-2025-14486: Missing Authorization

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

CVE-2025-14484: Missing Authorization

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

CVE-2026-18154: Use of Hard-coded Cryptographic Key

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key...

CVE-2026-94455: Missing Authentication for Critical Function

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

PT-2026-104837

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre shared key extension in the ServerHello that the client never offered causes the client to complete the handshake without...

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side...

PT-2026-97096

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A remote attacker could obtain sensitive information because the software uses a hard-coded or predictable cryptographic key. Cryptographic...

PT-2026-96820

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.6 Description Deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header. In src/dashboardGuard.js, the isLocalRequest function...

CVE-2026-56681: Reliance on Untrusted Inputs in a Security Decision

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip...

ALSA-2026:69964 Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fixes: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 For more details about the security...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nss (UTSA-2026-090161)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090161 advisory. When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: tang (UTSA-2023-002173)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002173 advisory. A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become...