org.apache.sshd/sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation

A flaw was found in Apache MINA SSHD. When the server is configured to require multiple Secure Shell SSH public keys for authentication, it fails to verify that the submitted keys are distinct. A remote user can exploit this flaw by presenting the same public key twice to satisfy multi-key...

CVE-2026-78310

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-78310

The software DIAEnergie (versions before 1.11.00.022 ) is vulnerable to an Authorization Bypass caused by a user-controlled key . While the specific technical root cause and component are not detailed in the provided documents, the vulnerability allows for unauthorized access. No specific exploit...

EUVD-2026-85821

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

WordPress Masteriyo LMS plugin < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure vulnerability

Subscriber+ Quiz Answer Key Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Masteriyo - LMS versions 3.4.2...

CVE-2026-82850 Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

CVE-2026-82850 Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

CVE-2026-82850

The Masteriyo LMS WordPress plugin, prior to version 3.4.2 , fails to restrict access to quiz answer keys. This vulnerability allows any authenticated user , such as a student, to retrieve correct answers for any quiz on the site, even those in courses where they are not enrolled. The root cause ...

CVE-2026-97055

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

EUVD-2026-85774

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

CVE-2026-97055

SigNoz versions v0.8.0 before v0.143.0 are vulnerable to an authentication bypass because the JWT tokenizer signing secret defaults to an empty string. Since Config.Validate() fails to reject empty values, deployments without a configured secret sign and verify session tokens with an empty HMAC k...

PT-2026-97731

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description An authorization bypass exists due to the use of a user-controlled key. Recommendations Update to version 1.11.00.022 or later...

PT-2026-104934

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipw rx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

PT-2026-97835

Name of the Vulnerable Software and Affected Versions Liman Render Engine versions 1.0 through 1.2-74 Description A key exchange without entity authentication issue allows an Adversary in the Middle AiTM attack. This occurs when the system fails to properly verify the identity of the communicatin...

CVE-2026-79761: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on...

CVE-2026-77703: Key Exchange without Entity Authentication

Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle AiTM. This issue affects Liman Render Engine: from 1.0 before 1.2-75...

CVE-2026-94416: Authentication Bypass by Spoofing

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

CVE-2026-78310: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-14441: Comparison Using Wrong Factors

A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential...

PT-2026-98156

Name of the Vulnerable Software and Affected Versions OpenWA versions prior to 0.23.5 Description An issue exists where the 'GET /api/sessions/sessionId/groups/groupId/invite-code' endpoint and the GroupGetInviteCode MCP tool do not require an OPERATOR role. This allows a user with a valid VIEWER...