GHSA-JXW3-MJMX-3PQM Langflow: Weak Fernet Key via random.seed()

Summary Langflow uses Python's random module Mersenne Twister, a non-cryptographic PRNG seeded with the SECRETKEY to derive the Fernet encryption key for all stored user credentials API keys, LLM provider secrets, database passwords. When the SECRETKEY is shorter than 32 characters — a common...

CVE-2026-78861

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

CVE-2026-105392

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392 Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392 Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392 Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

EUVD-2026-92777

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392

A vulnerability exists in Lybbn Django-Vue-Lyadmin up to version 3.2.12 due to a hard-coded cryptographic key within the JWT Signing component. Specifically, the manipulation of the SECRET_KEY argument in backend/application/settings.py leads to the use of this hard-coded key. Remote exploitation...

CVE-2026-97305

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

CVE-2026-97070

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23...

CVE-2026-97070 WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23...

EUVD-2026-92586

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

CVE-2026-97305 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

jwt-spoof-tool

jwt-spoof-tool Tool Description : I made this tool for learning purpose and automating jwt token hijacking without depending on using burpsuite the code is well documented and easy to follow Based on CVE-2018-0114 The Vulnerabilty happend because in backend the server check jwk object embeded...

CVE-2026-71891

A flaw was found in Bouncy Castle. When validating Boneh-Lynn-Shacham BLS signature public keys, the library does not verify that a key is constructed on the canonical elliptic curve. An attacker can exploit this issue by supplying a specially crafted public key defined on an alternate curve. Thi...

Astra Linux – Vulnerability in libxml2

A issue was discovered in libxml2 before version 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logical errors. In one case, a double-free can occur...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: wifi: iwlwifi: mvm: fix an issue where the TXF key sanitizer might have an off-by-one error. iwlmvmfrobtxfkeyiter tracks the last matched byte position in the loop variable ‘i’. When a full key match is found match == keylen,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fix for invalid leaf access in btrfsquotaenable if the ref key is not found. If btrfssearchslotforread returns 1, it means that we did not find any key that is greater than or equal to the key we requested. This means that...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sctp: Handle the error returned from sctpauthasocinitactivekey. When an error is returned from sctpauthasocinitactivekey, the activekey is not actually updated. The old shkey remains freed while it’s still being used as the activ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KEYS: prevented NULL pointer dereference in findasymmetrickey. In findasymmetrickey, if all NULL values are passed as arguments to id0,1,2, the kernel will first emit a WARN message, but then there will be an oops because id2 wil...