RLSA-2026:76733 Important: rust-rpm-sequoia security update

An implementation of the RPM PGP interface using Sequoia. Security Fixes: sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

CVE-2019-5420

CVE-2019-5420 Ruby-on-Rails offers three different environments it can run in: development, test and production. You should obviously not have code running in development or test available on the internet but it as always happens for example in staging environments. Ruby-on-Rails uses...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

EUVD-2026-94174

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103378

The Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0-3.1.0 ) contains a vulnerability where it fails to restrict unauthenticated access to a log file stored in a web-accessible directory. The plugin writes the site's carrier integration key into this file during unauthenticated req...

StealthCrypter

💀StealthCrypter💀 📜 Description StealthCrypter is a powerful and easy-to-use encryption tool that helps you protect your sensitive files and directories using AES-256 encryption. Whether you need to safeguard personal documents or secure confidential data, CryptShield ensures that your files remai...

CVE-2026-16516

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

EUVD-2026-94165

src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSHMSGKEXDHGEXGROUP 31 and SSHMSGKEXDHGEXREPLY 33 when a server receives them from an unauthenticated client. IsMessageAllowedServer applies no direction check to the key exchange...

CVE-2026-84897

The wolfSSH server (through version 1.5.0 ) is vulnerable to CPU exhaustion and key exchange role confusion because it improperly admits server-to-client Diffie-Hellman group exchange messages from unauthenticated clients. Due to a missing direction check in IsMessageAllowedServer(), the server m...

CVE-2026-84897 wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion

src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSHMSGKEXDHGEXGROUP 31 and SSHMSGKEXDHGEXREPLY 33 when a server receives them from an unauthenticated client. IsMessageAllowedServer applies no direction check to the key exchange...

CVE-2026-84897 wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion

src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSHMSGKEXDHGEXGROUP 31 and SSHMSGKEXDHGEXREPLY 33 when a server receives them from an unauthenticated client. IsMessageAllowedServer applies no direction check to the key exchange...

CVE-2026-84897 wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion

src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSHMSGKEXDHGEXGROUP 31 and SSHMSGKEXDHGEXREPLY 33 when a server receives them from an unauthenticated client. IsMessageAllowedServer applies no direction check to the key exchange...

CVE-2026-16516 wolfSSH ECDSA host key curve not validated against negotiated algorithm

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

EUVD-2026-94161

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

CVE-2026-16516 wolfSSH ECDSA host key curve not validated against negotiated algorithm

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

CVE-2026-16516 wolfSSH ECDSA host key curve not validated against negotiated algorithm

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

CVE-2026-16516

The wolfSSH library contains a vulnerability in the ParseECCPubKey() function (located in src/internal.c) where it fails to validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the negotiated algorithm during the key exchange. Specifically, the software uses the blob's ...

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...