CVE-2026-79575

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...

PT-2026-88172

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-82059: Reachable Assertion

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

PT-2026-87077

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...

Important: redis:6 security update

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, ...

CVE-2026-81821: Use of Hard-coded Cryptographic Key

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...

cjose -- Use of Hard-coded Cryptographic Key

https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq reports: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm...

cjose -- Heap-based Buffer Overflow

https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj reports: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW,...

CVE-2026-69375: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network...

PT-2026-87413

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description An authorization bypass exists due to a user-controlled key, which allows an authorized attacker to perform tampering over a network. Recommendations At the moment, there is...

CVE-2026-69712: Use After Free

Use after free in Windows Key Distribution Center allows an authorized attacker to execute code over a network...

CVE-2026-28590: Improper Verification of Cryptographic Signature

In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-88161

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled sync ttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

CVE-2026-79575

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...

EUVD-2026-72912

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...

PT-2026-87117

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live restreams id in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configur...

PT-2026-87153

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Insufficient validation of shard key values during document insertion allows authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3328)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...

NewStart CGSL MAIN 7.02 : python-PyJWT Multiple Vulnerabilities (NS-SA-2026-0091)

The remote NewStart CGSL host, running version MAIN 7.02, has python-PyJWT packages installed that are affected by multiple vulnerabilities: - PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11...

CVE-2026-78462: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...