CVE-2026-15469

🔑 CVE-2026-15469 Hard-coded Mesh Group Private Key — TP-Link Deco XE75 / XE5300 / WE10800 A shared RSA-512 mesh group private key is baked into the firmware, letting a LAN-adjacent attacker impersonate a trusted mesh node, overwrite configuration, flash unsigned firmware, and pivot across the...

CVE-2026-85429 MOOS-IvP through 24.8.1 uFldNodeComms Node Message Source Spoofing

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODEMESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without...

CVE-2026-85429

MOOS-IvP uFldNodeComms (through version 24.8.1) trusts the source node identity from the message body rather than validating it against the connection source. An attacker can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notificat...

CVE-2026-15469

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who...

CVE-2026-15469

A hard-coded shared RSA-512 mesh group private key is embedded in the firmware of TP-Link Deco XE75 v3, XE5300 v3.6, and WE10800 v3.6. The key is used by the mesh protocol for node authentication, meaning it is identical across all affected devices rather than being device-specific. An attacker w...

CVE-2026-15469 Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who...

CVE-2026-15469 Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who...

EUVD-2026-64936

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who...

PT-2026-80926

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who...

Malicious code in n8n-nodes-task-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 991093c97f0d954740c4b72a2e7725a501df211c94634979ebadc52652f2ebe8 The package impersonates the n8n task-runner subsystem but its shipped n8n node MyNode.js is a no-op stub whose execute returns . The real payload...

MAL-2026-10999 Malicious code in n8n-nodes-task-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 991093c97f0d954740c4b72a2e7725a501df211c94634979ebadc52652f2ebe8 The package impersonates the n8n task-runner subsystem but its shipped n8n node MyNode.js is a no-op stub whose execute returns . The real payload...

MAL-2026-4393 Malicious code in @hanssoft/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063fa3a06df50a8c53c5eb05ac4d1214e6fa1edfb18d03c8484fa2014190659a Package name impersonates the well-known libsignal-node Signal Protocol library and ships a verbatim copy of its README, but the code is unrelated. O...

Malicious code in @shinzepelly/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957954ced5e6fb2e8ab6a666adf496ca2edc7575a4e202b593d6698b5d89809f Package impersonates the legitimate libsignal-node library description copied verbatim: "Open Whisper Systems' libsignal for Node.js" under an...

CVE-2026-32001

OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=node without device identity verification. Attackers can exploit this by claiming the node role during WebSocket handshake to inject...

CVE-2026-32001 OpenClaw < 2026.2.22 - Node Role Device-Identity Bypass via WebSocket Authentication

OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=node without device identity verification. Attackers can exploit this by claiming the node role during WebSocket handshake to inject...

CVE-2026-23812 Security Boundary Bypass via Routing Node Impersonation

A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or...

CVE-2026-23812

Technical details (vulnerable products, affected versions, or exploit specifics) are not publicly available in the provided documents. Monitor for updates from NVD/Red Hat/ENISA and vendor advisories.

CVE-2026-23812 Security Boundary Bypass via Routing Node Impersonation

A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or...

CVE-2025-62820

A flaw was found in Slack Nebula. An improper CIDR construction in the hostmap logic makes the inbound firewall overly permissive for nodes with certificates allowing subnets or multiple IPs. An attacker controlling such a node can send packets with arbitrary source IP addresses within the networ...

Security update for icinga2

This update for icinga2 fixes the following issues: CVE-2025-48057: A certificate incorrectly treated as valid can allow an attacker to impersonate a trusted node bsc1243747. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...