Linux Distros Unpatched Vulnerability : CVE-2026-92899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2024_1484)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241484 advisory. nss: timing attack against RSA decryption CVE-2023-5388 Mozilla: Crash in NSS TLS method CVE-2024-0743 Mozilla: JIT code failed to save return registers on...

Rocky Linux 10.2 [CIQ] Security Update: keylime / keylime-base / keylime-registrar / keylime-selinux / etc (crlsa-2026_28582)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202628582 advisory. keylime: Keylime: Security bypass due to hardcoded TPM quote nonce CVE-2026-6420 Tenable has extracted the preceding description block directly from the CIQ...

DEBIAN-CVE-2026-92899

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

CVE-2026-92899

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

CVE-2026-92899

The Apache WSS4J library is vulnerable to a replay protection bypass because it stores the Nonce of a UsernameToken as raw base64 text. While authentication uses the decoded bytes, an attacker can re-send a captured request with a space added to the base64 Nonce; the password digest remains valid...

CVE-2026-92899 Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

CVE-2026-92899

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

CVE-2026-92899 Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

EUVD-2026-89798

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

EUVD-2026-89614

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

CVE-2026-88797 Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

SUSE SLES16 Security Update : perl-Authen-SASL (SUSE-SU-2026:23913-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:23913-1 advisory. This update for perl-Authen-SASL fixes the following issue: - CVE-2026-86219: replayed authentication responses accepted due to unverified...

CVE-2026-92899: Authentication Bypass by Spoofing

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - 인증 없이 임의 파일 업로드 설명 : User Registration Advanced Fields = 1.6.20 - 인증 없이 임의 파일 업로드 설명 WordPress용 User Registration Advanced Fields 플러그인1.6.20 이하 버전은 urafprofilepictureuploadmethodupload AJAX 액션을 통해 인증되지 않은 임의 파일 업로드에 취약합니다. 이 플러그인은 등록 양식이...

CVE-2026-54872

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

AZL-105621 CVE-2026-54872 affecting package openvmm 0.1.0-1

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

CVE-2026-54872 Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

CVE-2026-54872 Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: Optimole WordPress 플러그인의 CSRF로 인한 임의 파일 덮어쓰기 요약 Optimole WordPress 플러그인버전 = 4.2.5에서 발견된 CSRFCross-Site Request Forgery 취약점으로 인해, 인증되지 않은 공격자가 nonce 검증 부재로 인해 wpajaxoptmlreplacefile AJAX 액션을 통해 기존 미디어 라이브러리 자산을 무단으로 덮어쓸 수 있습니다. CVE ID : CVE-2026-11784 취약점 유형 : CSRF Cross-Site Reque...