CVE-2026-78310: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-14441: Comparison Using Wrong Factors

A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential...

CVE-2026-91161: Incorrect Authorization

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/sessionId/groups/groupId/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group...

PT-2026-98156

Name of the Vulnerable Software and Affected Versions OpenWA versions prior to 0.23.5 Description An issue exists where the 'GET /api/sessions/sessionId/groups/groupId/invite-code' endpoint and the GroupGetInviteCode MCP tool do not require an OPERATOR role. This allows a user with a valid VIEWER...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124478)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124478 advisory. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a maliciou...

PT-2026-97791

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform affected versions not specified Description An authorization bypass exists in the gateway API that allows an authenticated administrator to create a new service key for the Controller service cluster. Since this...

CVE-2026-75558: Use of Hard-coded Cryptographic Key

The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password a...

PT-2026-98308

Alright, so I saw this Wordfence report from last week and honestly my jaw dropped. Nearly 50 plugins and themes dropped with active, unpatched vulnerabilities in a single week. That's not a normal week. That's a red flag waving right in our faces. And look, I get it. We all know the WordPress...

PT-2026-98155

Name of the Vulnerable Software and Affected Versions OpenWA versions prior to 0.23.5 Description The /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through a wildcard subscription, bypassing the OPERATOR role requirement normally...

CVE-2026-91160: Missing Authorization

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

PT-2026-98195

Name of the Vulnerable Software and Affected Versions @rsdoctor/rspack-plugin versions prior to 1.5.16 Description The default report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint without authentication and with...

PT-2026-98275

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who extracts this cryptographic material...

PT-2026-98304

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic flaw in Java cache key handling object comparison could lead to improper identifier resolution when processing specific user account structures. This iss...

CVE-2026-61782: Exposure of Sensitive Information to an Unauthorized Actor

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

PT-2026-98231

Name of the Vulnerable Software and Affected Versions MongoDB Python Driver affected versions not specified Description Client-side field level encryption support may incorrectly interpret a key management endpoint value ending in ".sock" as a local Unix domain socket path instead of a remote hos...

PT-2026-104934

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipw rx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

Linux Distros Unpatched Vulnerability : CVE-2026-93785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key-datalen, which is limited to U16MAX. Accepting a larger key...

CVE-2026-79762: Use of Hard-coded Cryptographic Key

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

PT-2026-97835

Name of the Vulnerable Software and Affected Versions Liman Render Engine versions 1.0 through 1.2-74 Description A key exchange without entity authentication issue allows an Adversary in the Middle AiTM attack. This occurs when the system fails to properly verify the identity of the communicatin...

EUVD-2026-85654

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addbinding/3 parses the routing key as an integer weight N and computes ring positions with lists:seqNextN0, NextN0 + N - 1. validatebinding/2 only checks N = 1 , no upper bound. The resulti...