CVE-2026-14441: Comparison Using Wrong Factors

A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential...

CVE-2026-91161: Incorrect Authorization

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/sessionId/groups/groupId/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group...

PT-2026-98231

Name of the Vulnerable Software and Affected Versions MongoDB Python Driver affected versions not specified Description Client-side field level encryption support may incorrectly interpret a key management endpoint value ending in ".sock" as a local Unix domain socket path instead of a remote hos...

Linux Distros Unpatched Vulnerability : CVE-2026-93785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key-datalen, which is limited to U16MAX. Accepting a larger key...

PT-2026-97791

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform affected versions not specified Description An authorization bypass exists in the gateway API that allows an authenticated administrator to create a new service key for the Controller service cluster. Since this...

CVE-2026-75558: Use of Hard-coded Cryptographic Key

The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password a...

PT-2026-98156

Name of the Vulnerable Software and Affected Versions OpenWA versions prior to 0.23.5 Description An issue exists where the 'GET /api/sessions/sessionId/groups/groupId/invite-code' endpoint and the GroupGetInviteCode MCP tool do not require an OPERATOR role. This allows a user with a valid VIEWER...

PT-2026-98308

Alright, so I saw this Wordfence report from last week and honestly my jaw dropped. Nearly 50 plugins and themes dropped with active, unpatched vulnerabilities in a single week. That's not a normal week. That's a red flag waving right in our faces. And look, I get it. We all know the WordPress...

PT-2026-98155

Name of the Vulnerable Software and Affected Versions OpenWA versions prior to 0.23.5 Description The /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through a wildcard subscription, bypassing the OPERATOR role requirement normally...

CVE-2026-91160: Missing Authorization

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

PT-2026-98275

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who extracts this cryptographic material...

PT-2026-104934

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipw rx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

CVE-2026-79762: Use of Hard-coded Cryptographic Key

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

CVE-2026-78310: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

PT-2026-97731

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description An authorization bypass exists due to the use of a user-controlled key. Recommendations Update to version 1.11.00.022 or later...

PT-2026-97835

Name of the Vulnerable Software and Affected Versions Liman Render Engine versions 1.0 through 1.2-74 Description A key exchange without entity authentication issue allows an Adversary in the Middle AiTM attack. This occurs when the system fails to properly verify the identity of the communicatin...

PT-2026-98007

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rsi hal load key function where tx mic key and rx mic key are copied from data16 and data24 regardless of the cipher being used. Since these offsets are specific t...

PT-2026-97985

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cifs.idmap key type where the payload length is stored in key-datalen, which is limited to U16 MAX. If a key payload larger than this limit is accepted, the record...

CVE-2026-93785: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key-datalen, which is limited to U16MAX. Accepting a larger key payload truncates the recorded length and can make later users interpret...

CVE-2026-61782: Exposure of Sensitive Information to an Unauthorized Actor

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...