OESA-2026-2984 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though th...

OESA-2026-2985 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though th...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the views.py process of the Dashboard Module. An attacker can gain unauthorized access to restricted dashboard functionalities by sending crafted requests to endpoints without proper...

CVE-2026-16207

A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This attack is characterized...

EUVD-2026-45418

A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This attack is characterized...

CVE-2026-16207 django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings

A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This attack is characterized...

CVE-2026-16207

CVE-2026-16207 affects django-tastypie up to 0.15.1, specifically ApiKeyAuthentication in tastypie/authentication.py. The issue allows use of the GET method with sensitive query strings, enabling a remote attack. The reported attack is characterized by high complexity and low exploitability. The ...

PT-2026-61458

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference exists in the ksmbd module. During durable-handle session teardown, the session fd check function sets op-conn to NULL for matching opinfo entries, but these...

PT-2026-69547

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fscrypt component where the fscrypt get devices function uses a dynamically allocated array to store block device pointers. This allocation can fail, particularly...

Fedora 44 : openssh (2026-c9d8542bb3)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c9d8542bb3 advisory. - CVE-2026-59996: Fix remote glob result of .. causing files to be placed in unintended parent directories when scp performs remote-to-remote copy v...

PT-2026-69548

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fscrypt component where the fscrypt direct keys table, used by v1 encryption policies with FSCRYPT POLICY FLAG DIRECT KEY, fails to compare the super block pointer...

Linux Distros Unpatched Vulnerability : CVE-2026-63823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - keys: Pin requestkeyauth payload in instantiate paths A: requestkey B: KEYCTLINSTANTIATEIOV ================ ========================= create auth key store rka...

The Finite Key Effect of Side-Channel-Secure Quantum Key Distribution beyond Post-Selection Technique

By applying the framework of entropic uncertainty relation EUR and the Quantum Leftover Hash Lemma QLHL, we introduce a security-proof method for variable-length side-channel-secure SCS quantum key distribution QKD against coherent attacks. This method reframes composable security as a statistica...

PT-2026-61332

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the keyring code where the find key to update function calls assoc array find without holding the RCU Read-Copy-Update read lock. RCU is a synchronization mechanism th...

PT-2026-61139

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel during the handling of request key auth payloads. The problem occurs during a concurrency scenario involving the request key function an...

Use Of Hard-coded Cryptographic Key

Kimai is vulnerable to Use of Hard-coded Cryptographic Key. The vulnerability is due to the official Docker image using a publicly known default APPSECRET that is neither overridden nor validated, which allows an unauthenticated attacker to forge HMAC-signed cookies and login links to compromise...

Authentication Bypass

netlicensing-mcp is vulnerable to Authentication Bypass. The vulnerability is due to the API key middleware failing to enforce authentication and falling back to the server operator's API key, which allows an unauthenticated attacker to invoke privileged MCP operations under the operator's identi...

Sensitive Information Disclosure

cyberdrop-dl-patched is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper host validation that matches supported domains using substring checks, which allows an attacker to use a malicious lookalike domain and capture the user's API key through the Authorization...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @fastify/reply-from is a forward your HTTP request to another server, for fastify Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the getUpstream function. An attacker can gain unauthorized access to or modify data across differen...

CVE-2026-16158

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...