57711 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-82060
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted,...
RHEL 10 : openssh (RHSA-2026:65900)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65900 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary...
Linux Distros Unpatched Vulnerability : CVE-2026-80924
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: krb5 - use kfreesensitive for derived key buffers cryptokrb5prepareencryption and cryptokrb5preparechecksum free the buffer holding the freshly derived...
Linux Distros Unpatched Vulnerability : CVE-2026-87736
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points. CVE-2026-877...
Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138
This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must hav...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2026-106769)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106769 advisory. libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps...
PT-2026-89094
In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfree sensitive for derived key buffers crypto krb5 prepare encryption and crypto krb5 prepare checksum free the buffer holding the freshly derived keys with plain kfree, leaving the key material behind in the...
Microsoft Azure Active Directory B2C Authentication Bypass Privilege Escalation
The vulnerability of the Microsoft Azure Active Directory B2C access and identity management service relates to the bypassing of authentication processes by using a user-controlled key. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...
EUVD-2026-74299
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...
CVE-2026-53939
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" together with any key-management...
CVE-2026-53939
OpenIDC/cjose is a C library implementing JOSE. In versions 0.6.1 through 0.6.2.5 , when encrypting a JWE using an AES-CBC-HMAC content-encryption algorithm (A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512) with any key-management algorithm that generates a fresh CEK, the CEK is all zero bytes ins...
CVE-2026-53939
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...
CVE-2026-53938 OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW does not validate the length of the attacker-supplied encryptedkey JWE...
CVE-2026-53938
OpenIDC/cjose , a C library implementing JOSE, is affected by a heap buffer overflow in its JWE decryption path for the AES Key Wrap algorithms (A128KW, A192KW, A256KW) prior to version 0.6.2.5 . The root cause is a missing length validation of the attacker-supplied encrypted_key before unwrappin...
CVE-2026-53938
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW does not validate the length of the attacker-supplied encryptedkey JWE...
CVE-2026-53938 OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW does not validate the length of the attacker-supplied encryptedkey JWE...
EUVD-2026-74298
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW does not validate the length of the attacker-supplied encryptedkey JWE...
CVE-2026-53938
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms "alg" = "A128KW", "A192KW", "A256KW" does not validate the length of the attacker-supplied "encryptedke...
CVE-2026-53938 OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW does not validate the length of the attacker-supplied encryptedkey JWE...