PT-2026-88523

Name of the Vulnerable Software and Affected Versions OpenIDC/cjose versions prior to 0.6.2.5 Description The JWE decryption path for AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW fails to validate the length of the encrypted key before unwrapping it into a fixed-size,...

CVE-2026-81821: Use of Hard-coded Cryptographic Key

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...

Important: redis:6 security update

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, ...

cjose -- Use of Hard-coded Cryptographic Key

https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq reports: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm...

cjose -- Heap-based Buffer Overflow

https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj reports: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW,...

CVE-2026-69375: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network...

PT-2026-87413

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description An authorization bypass exists due to a user-controlled key, which allows an authorized attacker to perform tampering over a network. Recommendations At the moment, there is...

CVE-2026-69712: Use After Free

Use after free in Windows Key Distribution Center allows an authorized attacker to execute code over a network...

CVE-2026-28590: Improper Verification of Cryptographic Signature

In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-79575

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...

EUVD-2026-72912

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...

CVE-2026-82059: Reachable Assertion

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

PT-2026-87117

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live restreams id in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configur...

PT-2026-87153

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Insufficient validation of shard key values during document insertion allows authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in...

CVE-2026-79575

The software yfexam-exam v2.0 contains a vulnerability where the JWT signing secret is derived from the username and the current month rather than using a random server-side key. This insufficient randomness allows an attacker to obtain the secret key through a bruteforce attack . No specific exp...

PT-2026-88172

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-78462: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Trapdoor Functions with Secure Key Leasing and Copy Protection

Inspired by the no-cloning theorem in quantum theory, a variety of quantum cryptographic primitives with unclonable functionalities, such as secure key leasing and copy protection, have been proposed and attracted significant attention. However, trapdoor functions TDFs, fundamental primitives in...

PT-2026-87672

Use after free in Windows Key Distribution Center allows an authorized attacker to execute code over a network...

PT-2026-87152

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An internal aggregation expression was incorrectly registered as accessible to any authenticated user instead of being restricted to internal cluster operations. An authenticated user...