57606 matches found
PT-2026-87113
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...
CVE-2026-81821: Use of Hard-coded Cryptographic Key
The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...
CVE-2026-69375: Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network...
PT-2026-87413
Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description An authorization bypass exists due to a user-controlled key, which allows an authorized attacker to perform tampering over a network. Recommendations At the moment, there is...
PT-2026-88523
Name of the Vulnerable Software and Affected Versions OpenIDC/cjose versions prior to 0.6.2.5 Description The JWE decryption path for AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW fails to validate the length of the encrypted key before unwrapping it into a fixed-size,...
PT-2026-88161
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled sync ttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...
CVE-2026-69712: Use After Free
Use after free in Windows Key Distribution Center allows an authorized attacker to execute code over a network...
CVE-2026-28590: Improper Verification of Cryptographic Signature
In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-79575
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...
EUVD-2026-72912
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...
CVE-2026-82059: Reachable Assertion
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...
EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3253)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...
NewStart CGSL MAIN 7.02 : python-PyJWT Multiple Vulnerabilities (NS-SA-2026-0091)
The remote NewStart CGSL host, running version MAIN 7.02, has python-PyJWT packages installed that are affected by multiple vulnerabilities: - PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11...
PT-2026-87117
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live restreams id in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configur...
PT-2026-87153
Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Insufficient validation of shard key values during document insertion allows authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in...
CVE-2026-79575
The software yfexam-exam v2.0 contains a vulnerability where the JWT signing secret is derived from the username and the current month rather than using a random server-side key. This insufficient randomness allows an attacker to obtain the secret key through a bruteforce attack . No specific exp...
PT-2026-88172
Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...
CVE-2026-78462: Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
Trapdoor Functions with Secure Key Leasing and Copy Protection
Inspired by the no-cloning theorem in quantum theory, a variety of quantum cryptographic primitives with unclonable functionalities, such as secure key leasing and copy protection, have been proposed and attracted significant attention. However, trapdoor functions TDFs, fundamental primitives in...