CVE-2026-79551: Use of Hard-coded Cryptographic Key

Tenda Technology Co., Ltd NVR4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key...

CVE-2026-81855: Use of Hard-coded Cryptographic Key

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard...

CVE-2026-78225: Use of Hard-coded Cryptographic Key

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard...

EUVD-2026-78815

Tenda Technology Co., Ltd NVR4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key...

PT-2026-93221

Name of the Vulnerable Software and Affected Versions Secret Server affected versions not specified Description An unauthenticated user with access to Secret Server can utilize a padding oracle—a side-channel attack that reveals information about the padding of encrypted data—to decrypt or encryp...

PT-2026-93182

Name of the Vulnerable Software and Affected Versions Wärtsilä FOS-Onboard affected versions not specified Description A hardcoded cryptographic client authentication key exists within the robot testing framework component. This issue allows for the potential bypass of authentication mechanisms d...

CVE-2026-91935: Server-Side Request Forgery (SSRF)

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

PT-2026-92055

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

VulnCheck KEV: CVE-2026-89026

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

PT-2026-93181

Name of the Vulnerable Software and Affected Versions Wärtsilä FOS-Onboard affected versions not specified Description A hardcoded cryptographic server key exists within the deployer-ng Update Controller component. This issue involves the use of a fixed key for cryptographic operations, which can...

CVE-2026-79551

Tenda Technology Co., Ltd NVR4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key...

CVE-2026-92256: Insufficiently Protected Credentials

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpdconfigshowcgi.c, ipsecshowcgi.c, and modvpnremote/plan.json read handlers. Attackers can query l2tpdconfigshow.cgi to expose stored IPsec PSK and RSA key material...

CVE-2026-79551

The Tenda Technology Co., Ltd NVR_4H (hardware version CH3 v2.1 ) running firmware V27.5.58.6 contains a hardcoded ECDSA private key and certificate within the user-x.squashfs partition. Because these keys are embedded in the read-only filesystem and are identical across all devices running this ...

CVE-2026-86881

A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker with a compromised intermediate...

CVE-2026-53714

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor bu...

CVE-2026-12763

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component...

CVE-2026-86881

A certificate validation issue in Apple products allows an attacker with a compromised intermediate certificate authority to issue certificates with arbitrary extended key usages . This vulnerability affects iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS...

EUVD-2026-77977

A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker with a compromised intermediate...

CVE-2026-86881

A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker with a compromised intermediate...

CVE-2026-86881

A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker with a compromised intermediate...