SolarWinds Serv-U Authentication Bypass

The vulnerability of the software for secure file sharing and transmission of SolarWinds Serv-U is related to the ability to bypass authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely intercept sessions and gain control of the user account...

PT-2026-89149

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

CVE-2026-87025: Authorization Bypass Through User-Controlled Key

Tanium addressed an improper access controls vulnerability in Comply...

PT-2026-102364

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x Description An issue exists in the HMACAlgorithm.prepare key function within jwt/algorithms.py where the raw-JWK detector fails to normalize Unicode byte-order marks BOM before JSON validation. When a publi...

CVE-2026-19729: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must hav...

CVE-2026-78481: Use of Hard-coded Cryptographic Key

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism...

CVE-2026-78486: Use of Hard-coded Cryptographic Key

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...

CVE-2026-53939: Use of Hard-coded Cryptographic Key

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...

SolarWinds Serv-U Privilege Escalation

The vulnerability of the software for secure file sharing and transmission of SolarWinds Serv-U is related to the bypassing of authentication using a user-controlled key. Exploiting this vulnerability allows an attacker, operating remotely, to elevate their privileges to that of a system...

CVE-2026-53938: Heap-based Buffer Overflow

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW does not validate the length of the attacker-supplied encryptedkey JWE...

PT-2026-102350

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x Description The HMACAlgorithm.from jwk function is affected because the PyJWK verification path uses the decoded key without applying prepare key validation. This occurs when a trusted JSON Web Key JWK Set...

PT-2026-88972

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...

CVE-2026-50165: Improper Access Control

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

PT-2026-89110

MaxSite CMS through 109.6 passes the ci session cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achiev...

CVE-2026-80339: Exposure of Sensitive Information to an Unauthorized Actor

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

PT-2026-89094

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfree sensitive for derived key buffers crypto krb5 prepare encryption and crypto krb5 prepare checksum free the buffer holding the freshly derived keys with plain kfree, leaving the key material behind in the...

CVE-2026-80340: Exposure of Sensitive Information to an Unauthorized Actor

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that...

CVE-2026-79735: Use of Hard-coded Cryptographic Key

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information...

PT-2026-88862

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that...