CVE-2026-107219

The Excelize Go language library (versions 2.3.1 to 2.11.0 ) is vulnerable to an uncontrolled resource consumption flaw (CWE-400) during the OpenFile operation. The agileDecrypt function accepts an attacker-controlled spinCount from a crafted OLE encrypted-workbook header and passes it to convert...

rust-sequoia-sq security, bug fix, and enhancement update

An update is available for rust-sequoia-sq. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Command-line frontends for Sequoia. Security Fixes: sequoia-openpgp:...

RLSA-2026:76737 Important: rust-sequoia-sq security, bug fix, and enhancement update

Command-line frontends for Sequoia. Security Fixes: sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Unbundle capnproto from sequoia-sq rhel-10.2.z JIRA:Rocky Linux-177547 For more details about the security...

Exploit for CVE-2026-96451

CVE-2026-96451 WordPress Ultimate Member plugin = 2.13.1 -...

DRUPAL-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

WordPress Nexi XPay Build plugin <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure vulnerability

Unauthenticated Payment Completion and Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Nexi XPay Build versions = 7.6.2...

CVE-2024-3408-dtale

CVE-2024-3408 - Omisión de autenticación y RCE en D-Tale Entorno de laboratorio reproducible para CVE-2024-3408, una vulnerabilidad de omisión de autenticación y ejecución remota de código en D-Tale. Vulnerabilidad Las versiones de D-Tale hasta la 3.15.1 son vulnerables debido a: 1. SECRETKEY...

GHSA-FH39-C73X-5PJV Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

The @quasar/ssl-certificate development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local attacker with filesyst...

EUVD-2026-93570

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions...

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

The @quasar/ssl-certificate development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local attacker with filesyst...

immich-exfiltration-demo

Cybersecurity demo: Immich exfiltration CVE-2026-35455 Proof-of-concept cybersecurity demo for CVE-2026-35455, showcasing automated API key generation and data exfiltration leading to full account hijacking and persistent unauthorized access. Learn more: report, video...

cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service

A flaw was found in cjose, a C library for Javascript Object Signing and Encryption JOSE. A remote, unauthenticated attacker can exploit a heap buffer overflow vulnerability in the AES Key Wrap decryption process. By submitting a crafted Javascript Web Encryption JWE to an application, the attack...

CVE-2026-107177

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine th...

CVE-2026-107177 Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine th...

CVE-2026-107177 Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine th...

CVE-2026-107177

Express Gateway versions through 1.16.11 are vulnerable to a hardcoded cryptographic key flaw. The application uses a default crypto.cipherKey named 'sensitiveKey ', which allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets . Specifically, an attacker capable of readi...

EUVD-2026-94317

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine th...

RLSA-2026:76734 Important: rust-rpm-sequoia security, bug fix, and enhancement update

An implementation of the RPM PGP interface using Sequoia. Security Fixes: sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Uninformative error message on --import failure rhel-10.2.z JIRA:Rocky Linux-176906 Retu...

rust-rpm-sequoia security, bug fix, and enhancement update

An update is available for rust-rpm-sequoia. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list An implementation of the RPM PGP interface using Sequoia. Security...

rust-sequoia-sqv security update

An update is available for rust-sequoia-sqv. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A simple OpenPGP signature verification program. Security Fixes:...