PT-2026-98275

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who extracts this cryptographic material...

PT-2026-98304

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic flaw in Java cache key handling object comparison could lead to improper identifier resolution when processing specific user account structures. This iss...

CVE-2026-61782: Exposure of Sensitive Information to an Unauthorized Actor

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

PT-2026-98231

Name of the Vulnerable Software and Affected Versions MongoDB Python Driver affected versions not specified Description Client-side field level encryption support may incorrectly interpret a key management endpoint value ending in ".sock" as a local Unix domain socket path instead of a remote hos...

PT-2026-104934

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipw rx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

Linux Distros Unpatched Vulnerability : CVE-2026-93785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key-datalen, which is limited to U16MAX. Accepting a larger key...

CVE-2026-79762: Use of Hard-coded Cryptographic Key

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

CVE-2026-78310: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

PT-2026-97731

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description An authorization bypass exists due to the use of a user-controlled key. Recommendations Update to version 1.11.00.022 or later...

PT-2026-97835

Name of the Vulnerable Software and Affected Versions Liman Render Engine versions 1.0 through 1.2-74 Description A key exchange without entity authentication issue allows an Adversary in the Middle AiTM attack. This occurs when the system fails to properly verify the identity of the communicatin...

EUVD-2026-85654

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addbinding/3 parses the routing key as an integer weight N and computes ring positions with lists:seqNextN0, NextN0 + N - 1. validatebinding/2 only checks N = 1 , no upper bound. The resulti...

CVE-2026-67219

RabbitMQ is affected by a vulnerability where the add_binding/3 function fails to impose an upper bound on the routing key integer weight N in the consistent-hash exchange plugin. Because validate_binding/2 only ensures N >= 1 , an attacker with write permissions on a consistent-hash exchange ...

CVE-2026-84691

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string...

CVE-2026-82407

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...

SUSE-SU-2026:23910-1 Security update for cjose

This update for cjose fixes the following issues: - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap-based buffer overflow bsc1279844. - CVE-2026-53939: zero-filled content-encryption key generation in AES-CBC-HMAC JWE encryption within cjose ca...

OPENSUSE-SU-2026:21944-1 Security update for cjose

This update for cjose fixes the following issues: - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap-based buffer overflow bsc1279844. - CVE-2026-53939: zero-filled content-encryption key generation in AES-CBC-HMAC JWE encryption within cjose ca...

CVE-2026-82356

Imprivata EAM =26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices...

CVE-2026-82407 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...

EUVD-2026-85576

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...

CVE-2026-84691

A format-string injection vulnerability exists in the automation-controller component of Red Hat Ansible Automation Platform . The flaw arises because a setting for formatting API 4XX error log messages uses an administrator-controlled Python format-string template rendered with a live user objec...