PT-2026-94163

Name of the Vulnerable Software and Affected Versions Private Feed Key versions prior to 0.2 Description The Private Feed Key WordPress plugin fails to verify that the key used to authenticate a feed request was actually issued by the plugin. Instead, it matches the key against any stored user...

CVE-2026-86707: Improper Authentication

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

PT-2026-102926

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.11 Description The PyEnvCfg.write function writes prompt values verbatim to the line-oriented pyvenv.cfg format, while PyEnvCfg. read values parses the file using str.splitlines and accepts the last value for...

PT-2026-94957

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the qat alg xts reverse key function expands the forward XTS AES key on the stack. This process leaves sensitive key material within the stack frame, which could...

PT-2026-99691

The crate has had no releases since 0.7.1 2023-08-23, and the upstream repository shows no maintainer activity. Open pull requests, including a fix for a chosen-ciphertext key-recovery flaw in the AVX2 backend Argyle-Software/kyber121, have gone unanswered. Recommended alternatives: - aws-lc-rs -...

PT-2026-94189

Name of the Vulnerable Software and Affected Versions Acer System Monitoring affected versions not specified Description The Acer System Monitoring component, included with NitroSense and PredatorSense, contains a hard-coded AES encryption key. AES Advanced Encryption Standard is a symmetric bloc...

CVE-2026-93129: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-base: Fix handling of ultra performance key The commit message of commit 5fbd827eb9c2 "platform/x86: dell-wmi: Recognise or support new switches" states that the ultra performance key contains additional da...

PT-2026-94862

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the TXF key sanitiser within the iwlwifi module. The function iwl mvm frob txf key iter incorrectly calculates the memset start offset when a full key match...

CVE-2026-90102: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

Security update for mbedtls-2 (important)

openSUSE security update: security update for mbedtls-2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21864-1 Rating: important References: bsc1245810 bsc1252454 Cross-References: CVE-2025-52496 CVE-2025-59438 CVSS scores: CVE-2025-59438 SUSE : 5....

CVE-2026-64684 RMCP: Custom HTTP headers leak to cross-origin redirect targets

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamablehttpclient.rs builds its defaulthttpclient with reqwest's automatic redirect policy and applies caller-supplied values...

CVE-2026-92792

OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a testpurpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the testpurpose key in evidence and...

CVE-2026-92803 LibreTranslate through 1.9.6 Missing Access Check on the download_file Route

LibreTranslate through 1.9.6 omits the accesscheck decorator from the downloadfile route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances...

CVE-2026-92803 LibreTranslate through 1.9.6 Missing Access Check on the download_file Route

LibreTranslate through 1.9.6 omits the accesscheck decorator from the downloadfile route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances...

CVE-2026-92792 OpenNHP through 1.0.2 Authentication Bypass via Fallback Verifier

OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a testpurpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the testpurpose key in evidence and...

EUVD-2026-81055

OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a testpurpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the testpurpose key in evidence and...

CVE-2026-92792 OpenNHP through 1.0.2 Authentication Bypass via Fallback Verifier

OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a testpurpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the testpurpose key in evidence and...

CVE-2026-92760 Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

CVE-2026-92760

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens. Attackers holding restricted keys (author-only or domain-only) can access the mercure-info endpoint and receive visit data—including referrer, user agent, geolocation, and full short URL obje...

USN-8776-1: python-cryptography vulnerabilities

It was discovered that python-cryptography incorrectly accepted objects with immutable buffers when performing certain cipher operations. This would result in corrupted output, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. CVE-2023-23931 It was discovered that...