DEBIAN-CVE-2026-81013

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

AZL-100424 CVE-2026-81013 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81013

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation

A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...

apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation

A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...

Oracle Linux 10 : ELSA-2026-66392-0: / apr-util (ELSA-2026-663920)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-663920 advisory. - Resolves: RHEL-236629 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 ...

Silverpeas-AuthBypass-CVE-2024-36042

Silverpeas-AuthBypass-CVE-2024-36042 一个简洁、专业级的 Python3 概念验证工具，针对 CVE-2024-36042 —— Silverpeas 6.3.5 中的身份验证绕过漏洞，该漏洞由 AuthenticationServlet 缺少密码验证所致。 概述 Silverpeas AuthenticationServlet 即使在 POST 请求体中省略 Password...

CVE-2026-85649

Holloway Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's...

CVE-2026-85649

Holloway Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's...

CVE-2026-85649

Actualizer v1.2.0 and earlier by (Holloway) Chew, Kean Ho contains a fail-open password validation vulnerability in the Alpha and root user password loops of Shell/debian-minbase-install.sh . The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's retu...

Linux Distros Unpatched Vulnerability : CVE-2023-42179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process. CVE-2023-42179...

CVE-2023-42179

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process...

CVE-2023-42179

Bird Home Automation GmbH D1101V-F 000140 is affected by an Incorrect Access Control vulnerability stemming from flaws in the key derivation process and the password validation process . The CVSS 3.1 base score is 9.8 (Critical) , with a network vector requiring no privileges or user interaction ...

EUVD-2023-60608

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process...

CVE-2023-42179

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process...

PT-2026-82228

Name of the Vulnerable Software and Affected Versions Bird Home Automation GmbH D1101V-F 000140 affected versions not specified Description Incorrect access control exists due to flaws in the key derivation process and the password validation process. Recommendations At the moment, there is no...

apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation

A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...

CVE-2026-19507

CVE-2026-19507 affects the RDK-B WebUI (version rdkb-2025q4-kirkstone.04.10.26), an open-source web-based management interface for broadband gateways. The login handler in /usr/www2/check.jst does not limit password length before computing a SHA-256 hash on the entire submitted value. A remote, u...

PT-2026-73242

APR-util versions 1.6.3 and earlier function apr password validate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users ar...

CVE-2026-72804 SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document...