CVE-2026-93161

A flaw was found in the Linux kernel's crypto: qat module. The qatalgxtsreversekey function expands sensitive Advanced Encryption Standard AES key material on the stack. This key material is not properly cleared and can remain in the stack frame, potentially allowing a local attacker to access it...

CVE-2026-106105 Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only...

CVE-2026-106105 Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only...

CVE-2026-106105

The Quasar Framework contains a vulnerability where the @quasar/ssl-certificate utility caches combined private keys and certificates without applying owner-only filesystem permissions . This occurs in versions prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0....

CVE-2026-105849

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-105806

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

EUVD-2026-93492

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-105849

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-105806

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

EUVD-2026-93469

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

UBUNTU-CVE-2026-98221

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...

CVE-2026-98222

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

CVE-2026-98222 KEYS: encrypted: fix integer overflow of datablob_len

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

CVE-2026-98222

The Linux kernel contains an integer overflow vulnerability in the KEYS: encrypted subsystem. The function encrypted_key_alloc() stores datablob_len in a u16 variable. When the sum of various string and payload lengths exceeds U16_MAX , the allocation size is truncated, leading to a slab-out-of-b...

CVE-2026-98222 KEYS: encrypted: fix integer overflow of datablob_len

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

CVE-2026-85153

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials an...

CVE-2026-85153 Information Disclosure Vulnerability in Schmooze dating mobile Application

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials an...

CVE-2026-85153

The Schmooze dating mobile application contains a vulnerability caused by the use of hardcoded credentials and cryptographic keys within the client application. An unauthenticated remote attacker can exploit this by decompiling the distributed application package to extract the embedded secrets. ...

EUVD-2026-93017

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials an...

CVE-2026-85153 Information Disclosure Vulnerability in Schmooze dating mobile Application

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials an...