CVE-2026-82751 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsor...

CVE-2026-82751 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsor...

EEF-CVE-2026-82751 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

Summary Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server...

CVE-2026-82751

CVE-2026-82751 affects the ZenHive mpp library (Elixir), specifically MPP.Methods.Tempo.FeePayerPolicy.measure/3, in versions 0.2.0 through 0.16.0 . The function bounds gas fields, fee budgets, validity windows, and access lists of the client-signed 0x76 envelope but fails to check the optional k...

EUVD-2026-72147

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsor...

Exploit for CVE-2026-67276

MikroTrick lab PoC — CVE-2026-67276 RouterOS SSH public-key a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053434)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053434 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that...

PT-2026-86539

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsor...

Malicious code in array-scala (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78c71ee306356b5d27d673ae95bba2a24093aeac12e43044bd2503aa8c3d9024 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in trongridew (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...

MAL-2026-15936 Malicious code in trongridew (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...

CVE-2026-67276

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...

EUVD-2026-72024

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...

CVE-2026-67276 SSH user impersonation possible in Mikrotik RouterOS

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...

CVE-2026-67276

MikroTik RouterOS is vulnerable to an SSH public-key authentication bypass (CWE-347). The server matches a presented public-key blob to an authorized key by key type and modulus only, omitting the exponent , and performs signature verification using the client-supplied key . An attacker who knows...

CVE-2026-67276 SSH user impersonation possible in Mikrotik RouterOS

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...

Malicious code in discord-phub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 181fb5530173cb05bf3e2d2fd37a097924d5affad4b9e3438ceef5d399b01b0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lazy-attr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6e9ec6f580e2ecf0b9cf61f677666b18211e7056ffd5b3cb775f21356d0e351 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15977 Malicious code in discord-tqr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a86833e5a36c88fc9e53ced45f2d6d0ec40357cce7377aeec0da7e1f25666ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gas-price-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f8f9689168acafb514d0ab0bb8710f1fce42e95560a2a0c7e0e6788e913e729 Package advertises itself as a public-RPC gas price checker but on first call to the exported getGasPrice API in src/envcheck.cjs it walks the caller...