EUVD-2026-64056

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

Improper Handling of Alternate Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Alternate Encoding in its password normalization, which applies Unicode NFKC compatibility normalization before hashing and so folds fullwidth and other compatibility characters to their ASCII equivalents. An attack...

CVE-2026-53762: Use of Password Hash With Insufficient Computational Effort

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

CVE-2026-75112

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112

OTTO® Fleet Manager uses an insufficient bcrypt work factor, lowering the computational cost for offline brute-force attacks on stored password hashes if an attacker obtains an unencrypted system backup. CVSS 6.9 (Medium), ADJACENT vector. No exploitation reported; Rockwell advisory SD1791 refere...

EUVD-2026-62694

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112 OTTO® Fleet Manager – Weak Password Hashing Configuration

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112 OTTO® Fleet Manager – Weak Password Hashing Configuration

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-48162 Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

CVE-2026-75112: Use of Password Hash With Insufficient Computational Effort

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

PT-2026-78587

Name of the Vulnerable Software and Affected Versions OTTO® Fleet Manager affected versions not specified Description An issue exists due to the use of an insufficient work factor in the bcrypt password hashing implementation. This reduces the computational cost for attackers to perform offline...

EUVD-2026-60961

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...

CVE-2026-62684

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...

The Vulners team has released an updated version Getsploit

The Vulners team has released an updated version ofGetsploit. The utility allows you to search for public exploits in the Vulners.com database. It supports both an online mode search queries are executed on the Vulners server and a fully offline mode exploit data from Vulners is downloaded to a...

getsploit v3.0.1

Getsploit Search and download public exploits from theVulners database — online, or fully offline from a local index. Get an API key · Vulners search · Changelog · Architecture · Security policy !Getsploit searching online, building a local FTS5 index, then searching and mirroring...

Use of Password Hash With Insufficient Computational Effort

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

CVE-2026-74871

opensslencrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password...

PYSEC-2026-3976

opensslencrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password...

CVE-2026-74871

The jahlives/openssl_encrypt PHP package before 1.4.6 has a KDF bypass: in sequential XOR composition mode the final stage cancels out, so attackers with local access can crack passwords at SHA-256 speed instead of the configured memory-hard KDF cost. CVSS 6.2 (MEDIUM, local). No in-the-wild expl...

CVE-2026-74871

opensslencrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password...