RHEL 10 : rust-sequoia-sqv (RHSA-2026:76735)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:76735 advisory. A simple OpenPGP signature verification program. Security Fixes: sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag...

GHSA-X33G-CR3X-6449 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

Summary PyJWT accepts internally inconsistent OKP private JWKs where the declared public key x does not correspond to the supplied private key d. When d is present, OKPAlgorithm.fromjwk constructs the Ed25519/Ed448 private key from d without verifying that the public key derived from d matches x...

EUVD-2026-53547

Langflow: Weak Fernet Key via random.seed...

GHSA-JXW3-MJMX-3PQM Langflow: Weak Fernet Key via random.seed()

Summary Langflow uses Python's random module Mersenne Twister, a non-cryptographic PRNG seeded with the SECRETKEY to derive the Fernet encryption key for all stored user credentials API keys, LLM provider secrets, database passwords. When the SECRETKEY is shorter than 32 characters — a common...

Langflow: Weak Fernet Key via random.seed()

Summary Langflow uses Python's random module Mersenne Twister, a non-cryptographic PRNG seeded with the SECRETKEY to derive the Fernet encryption key for all stored user credentials API keys, LLM provider secrets, database passwords. When the SECRETKEY is shorter than 32 characters — a common...

CVE-2026-78861

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

CVE-2026-105392

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392 Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392 Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392 Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

EUVD-2026-92777

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392

A vulnerability exists in Lybbn Django-Vue-Lyadmin up to version 3.2.12 due to a hard-coded cryptographic key within the JWT Signing component. Specifically, the manipulation of the SECRET_KEY argument in backend/application/settings.py leads to the use of this hard-coded key. Remote exploitation...

CVE-2026-97305

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

CVE-2026-97070

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23...

CVE-2026-97070 WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23...

EUVD-2026-92586

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

CVE-2026-97305 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

jwt-spoof-tool

jwt-spoof-tool Tool Description : I made this tool for learning purpose and automating jwt token hijacking without depending on using burpsuite the code is well documented and easy to follow Based on CVE-2018-0114 The Vulnerabilty happend because in backend the server check jwk object embeded...

CVE-2026-71891

A flaw was found in Bouncy Castle. When validating Boneh-Lynn-Shacham BLS signature public keys, the library does not verify that a key is constructed on the canonical elliptic curve. An attacker can exploit this issue by supplying a specially crafted public key defined on an alternate curve. Thi...

Astra Linux – Vulnerability in libxml2

A issue was discovered in libxml2 before version 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logical errors. In one case, a double-free can occur...