CVE-2026-68452

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests ccacipher2protkey derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length...

PT-2026-71613

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/zcrypt component where the cca ecc2protkey function derives the copy length for the CPRB parameter block directly from the length field in the key token. This...

CVE-2026-56862: Allocation of Resources Without Limits or Throttling

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

PT-2026-71401

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...

PT-2026-80515

ModularSquareRoot in Crypto++ aka cryptopp through 8.9.0 allows attackers to cause a denial of service infinite loop via crafted DER public-key data associated with squared odd numbers, such as the square of 268995137513890432434389773128616504853...

CVE-2026-65935: Authentication Bypass by Primary Weakness

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below...

Vaulted Passkeys: A Device-Bound Proposal for Authenticated Credential Export and Import

Hardware authenticators deliberately resist private-key extraction, yet replacement, disaster recovery, and controlled migration create a legitimate need for portability. Existing guidance for device-bound credentials commonly reduces recovery risk by registering an additional authenticator befor...

CVE-2026-19293: Weak Password Requirements

SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...

Linux Distros Unpatched Vulnerability : CVE-2026-6726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a...

PT-2026-71880

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

CVE-2026-15413: Hidden Functionality

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...

PT-2026-71810

Name of the Vulnerable Software and Affected Versions Trigger.dev versions 3.3.8 through 4.5.5 Description The PUT '/api/v1/runs/:runId/metadata' endpoint fails to reject dangerous constructor and prototype path segments when passing operation.key values to the JSONHeroPath.set function. This...

PT-2026-71904

Name of the Vulnerable Software and Affected Versions luci-app-openvpn affected versions not specified Description Authenticated users can perform path traversal and write arbitrary files outside the intended directory because the software fails to properly validate the instance name2 parameter...

PT-2026-71650

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below...

CVE-2026-73659: Improper Limitation of a Pathname to a Restricted Directory

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

CVE-2026-56862: Allocation of Resources Without Limits or Throttling

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

PT-2026-71923

Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.3 OpenChoreo versions prior to 1.1.3 OpenChoreo versions prior to 1.2.0-rc.2 Description The 'POST /api/v1alpha1/autobuild' endpoint in 'internal/openchoreo-api/api/handlers/webhook handler.go' allows...

CVE-2026-73567: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...

PT-2026-76034

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

PT-2026-71611

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data price, cost, stock, SKU, and barcode of another company's product and t...