RockyLinux 10 : rust-sequoia-sq (RLSA-2026:76737)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76737 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Unbundle capnproto from...

RHEL 10 : rust-sequoia-sq (RHSA-2026:76737)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:76737 advisory. Command-line frontends for Sequoia. Security Fixes: sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion...

RockyLinux 10 : rust-rpm-sequoia (RLSA-2026:76734)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76734 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Uninformative error messa...

AlmaLinux 10 : rust-sequoia-sqv (ALSA-2026:76735)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:76735 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

AlmaLinux 9 : rust-rpm-sequoia (ALSA-2026:76733)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:76733 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

RockyLinux 9 : rust-rpm-sequoia (RLSA-2026:76733)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76733 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

PT-2026-107386

Name of the Vulnerable Software and Affected Versions wolfSSH affected versions not specified Description wolfSSH fails to validate that the ECDSA curve identifier in a KEXDH REPLY host key blob matches the algorithm negotiated during key exchange. In the ParseECCPubKey function, the blob's...

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

PT-2026-107668

Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10...

PT-2026-107434

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

PT-2026-107397

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

PT-2026-107498

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine th...

RHEL 8 : mod_auth_openidc:2.3 (RHSA-2026:77372)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77372 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Conne...

RockyLinux 10 : rust-sequoia-sqv (RLSA-2026:76735)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76735 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

CVE-2026-79960

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-102412

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

EUVD-2026-93933

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

CVE-2026-102412

Kibana versions 9.3.0 through 9.3.8 , 9.4.0 through 9.4.7 , and 9.5.0 through 9.5.4 are vulnerable to Incorrect Authorization (CWE-863) . An authenticated user with limited Fleet management privileges can bypass Access Control Lists (ACLs) to access sensitive credential material restricted to Fle...

CVE-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

CVE-2026-79960 Gitea deploy key pushes acting as the repository owner

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...