SUSE CVE-2026-69247

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

Malicious code in streak-test-mathcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1 Package main dist/index.mjs runs a top-level IIFE that spawns dist/math-core.bin via childprocess.spawn on any import of the package. The bundled ELF...

MAL-2026-11997 Malicious code in sextant-cli-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...

kernel security, bug fix, and enhancement update

4.18.0-553.151.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

PT-2026-68293

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description The software uses Python's non-cryptographic random module to generate Fernet encryption keys when user secrets are shorter than 32 characters. This process relies on the Mersenne...

CVE-2026-8470: Use of a Broken or Risky Cryptographic Algorithm

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

PT-2026-68104

Name of the Vulnerable Software and Affected Versions DjangoCRM affected versions not specified Description The software contains a hardcoded SECRET KEY within the webcrm/settings.py file instead of retrieving it from an environment variable. This key is critical for session signing, CSRF token...

CVE-2026-9205: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

PT-2026-68155

Name of the Vulnerable Software and Affected Versions ChirpStack affected versions not specified Description An authenticated user with device-list access can perform SQL injection when the SQLite backend is used. The issue occurs because the user-supplied tag key is interpolated directly into a...

PT-2026-68042

Name of the Vulnerable Software and Affected Versions changedetection.io affected versions not specified Description The /settings save handler creates an update dictionary from form.data'application' and merges it into the stored application settings using the .update method. Due to how WTForms...

CVE-2026-18411: Use of Hard-coded Cryptographic Key

The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access...

PT-2026-81370

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.74.4 Description The serve s3 function contains a path traversal flaw. This allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. By sending requests with object keys su...

PT-2026-68295

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description A Server-Side Request Forgery SSRF issue exists in the validate model provider key function for the Ollama provider. The function processes a user-supplied OLLAMA BASE URL parameter an...

CVE-2026-7658: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

CVE-2026-6639: Missing Authorization

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

kernel security, bug fix, and enhancement update

5.14.0-687.34.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

The Hidden Life of Public Safety Communications Signals: A Comparative Security Analysis of TETRA, TETRAPOL, and P25

Public-safety agencies and critical infrastructure operators rely on trunked land-mobile radio LMR systems, based on P25, TETRA, and TETRAPOL. These systems are expected to protect not just the content of a communication but the fact of it. Yet LMR standards leave a stark gap between...

SIMATIC CN 4100 RSA_public_encrypt Data Compromise

The vulnerability of the RSApublicencrypt function in the SIMATIC CN 4100 communication gateway software is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of the protected information...

PT-2026-68297

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS affected versions not specified Description An issue exists involving weak cryptographic key derivation within the ensure fernet key function. Key derivation is the process of deriving one or more secret keys from a master key...