CVE-2026-15065 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file...

CVE-2026-15065

IBM AIX NIM (versions 7.2, 7.3) and PowerVM VIOS 4.1 expose intermediate CA private keys in publicly available update files (CWE-312), allowing unauthenticated remote attackers to bypass security restrictions. IBM has released Service Packs (SP13/SP5/SP3/SP2) and Fix Packs (4.1.2.20/4.1.1.30/4.1....

CVE-2026-76234 libcrux before 0.0.6 Cryptographic Implementation Bug Fixes

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

MINI-MQV9-RMJ2-85J2

Bulletin has no description...

BIT-GOLANG-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

CVE-2024-31497-POC

CVE-2024-31497 POC यह भेद्यता ecc-ssh.c फ़ाइल में पक्षपाती ECDSA नॉनस जनरेशन का शोषण करती है। नॉनस $sha512ID\ ||\ sha512privKey\ ||\ sha1data\ mod\ q$ के साथ उत्पन्न होता है जिससे शीर्ष 9 बिट शून्य हो जाते हैं। निजी कुंजी को पुनर्प्राप्त करने के लिए हमें 60 हस्ताक्षरों की आवश्यकता है लेकिन 58 के...

CVE-2026-18051 W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 fails to validate the page cache key request path, enabling unauthenticated attackers to perform path traversal and write or overwrite arbitrary files anywhere on the server, including .htaccess on Apache. CVSS 10.0 (Critical) reflects no auth, no...

CVE-2026-16979

The SmartCrawl WordPress plugin (versions before 3.16.3) lacks capability checks on two AJAX actions, letting any Subscriber read private/draft post titles by ID and enumerate stored post-meta key names. CISA SSVC assesses partial technical impact with no known exploitation. No in-the-wild exploi...

Malicious code in api-rs-tuils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e65df9ad10889610f658c482041bdcf8c06d3c147da5cec709f246a1fa363c4 [email protected] runs a malicious postinstall hook node test.js that executes obfuscated code in index.js against the installer's machine. The code...

CVE-2026-19500-poc

CVE-2026-19500 Poc 및 writeup 설명 Sureforms는 DOS 취약점에 취약합니다. 공격자가 무제한의 키-값 쌍을 제출하면 리소스 고갈이 발생하고, 관리자는 일시적으로 항목을 볼 수 없게 됩니다. 재현 방법 Sureforms 플러그인으로 생성된 양식을 제출한 다음, 큰 크기의 콘텐츠를 포함한 대량의 키-값 쌍을 생성하여 제출합니다. 몇 번만 제출하면 관리자가 항목을 볼 수 없게 됩니다. 이 Poc를 몇 번 실행해도 취약점이 악용될 수 있습니다. 수정 방법 문제를 부분적으로 패치한 최신 버전2.1.3 이상으...

PT-2026-78428

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Network Installation Management NIM could allow a remote attacker to bypass security restrictions. This issue occurs because intermediate certificate authority private keys...

CVE-2026-56684

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8...

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8...

UBUNTU-CVE-2026-23933

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions...

PT-2026-78504

Name of the Vulnerable Software and Affected Versions Wazuh Manager versions 4.0.0 through 4.14.4 Description A low-privilege read-only API user with manager:read permission can retrieve the cluster key from the ossec.conf element via the 'GET /manager/configuration?raw=true' endpoint. An attacke...

CVE-2026-23933

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions...

Malicious code in fast-glob-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408 fast-glob-fast is a name-squat of the popular fast-glob package its repository field even points at mrmlnc/fast-glob. The declared postinstall hook...

CVE-2026-55593

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The...

CVE-2026-53456

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...