CVE-2026-17578

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

EUVD-2026-53299

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

CVE-2026-17578 Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

CVE-2026-17578

Kong Event Gateway vulnerable components: versions 1.0.0–1.1.1 and 1.2.0 fail to enforce key rotation before reaching the NIST SP 800-38D usage limit for AES-GCM keys when AWS IAM encryption is enabled. Under sustained high message rates that trigger a reboot without rotation, nonce collisions be...

CVE-2026-71204

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CVE-2026-6639

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

CVE-2026-55997

CVE-2026-55997 concerns Rancher where long-lived registration tokens used to authenticate nodes/agents into a downstream cluster were stored in plaintext with no expiration. The tokens could be obtained via the Rancher API, etcd, automation, or direct file access on a node and used at any time to...

EUVD-2026-53201

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update. Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased...

CVE-2026-71204

The CVE-2026-71204 entry concerns changedetection.io. A POST to /settings that omits api_access_token_enabled causes the update logic to silently disable API key enforcement because WTForms treats unchecked checkboxes as False and only the password field is specially handled. This results in the ...

CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

CVE-2026-6639

The CVE concerns the AI Chatbot & Workflow Automation by AIWU WordPress plugin (

SUSE CVE-2026-69247

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

MAL-2026-11997 Malicious code in sextant-cli-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...

kernel security, bug fix, and enhancement update

4.18.0-553.151.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

The vulnerability of the RSA_public_encrypt() function in the software of the SIMATIC CN 4100 communication gateway allows a perpetrator to compromise the confidentiality of the protected information.

The vulnerability of the RSApublicencrypt function in the SIMATIC CN 4100 communication gateway software is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of the protected information...

kernel security, bug fix, and enhancement update

5.14.0-687.34.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext

A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman ECDH ciphertext to the gcrypkdecrypt function. This can lead to a heap-based buffer overflow, potentially causing a denial of service DoS condition...

GHSA-8GJ2-2CVC-6XX7 Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

Summary The /api/v1/text-to-speech/generate endpoint is whitelisted requires no authentication and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential OpenAI or...