CVE-2026-64798

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

EUVD-2026-47809

Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

CVE-2026-64798

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

CVE-2026-64798

Summary: CVE-2026-64798 affects the Joomla Extension from regularlabs.com, specifically the IP login extension. The root cause is the use of a non-cryptographic random generator with insufficient entropy to generate persistent URL login keys. Impact: high confidentiality and integrity risk for lo...

CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

GHSA-HRXH-6V49-42GF vulnerabilities

Vulnerabilities for packages: buildah, envoy-ratelimit, spire-server, tetragon, vault-secrets-webhook, vault-env, kubernetes-csi-livenessprobe, sftpgo-plugin-eventsearch, step-ca, crossplane-provider-family-aws, vault-benchmark, jaeger, authservice, terraform-provider-tls,...

CVE-2026-64829

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...

EUVD-2026-47782

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...

CVE-2026-64829

CVE-2026-64829 affects Question2Answer up to version 1.8.8. The issue is a session invalidation bug in the forgot-password flow: the handler qa_finish_reset_user() does not clear the sessioncode, allowing a previously issued remember-me cookie to continue authenticating the account after a passwo...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

PT-2026-63509

Name of the Vulnerable Software and Affected Versions Joomla Extension - regularlabs.com - IP login extension affected versions not specified Description The IP login extension generates persistent URL login keys using a non-cryptographic random generator with insufficient entropy, which can lead...

Exploit for CVE-2026-60137

How does this work at all !plotd...

New ClickLock Stealer locks your Mac until you hand over your password

ClickLock Stealer is a new, modular macOS infostealer delivered via ClickFix-style phishing pages that can lock a victim’s Mac, steal their macOS password, browser and password manager data, cryptocurrency wallets, and then leave behind a persistent backdoor. The malware was discovered by Group-I...

CVE-2026-65007

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

Oracle Linux 10 : freerdp (ELSA-2026-36203)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36203 advisory. - Backport several CVE fixes CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700 Resolves: RHEL-186978, RHEL-186967,...

CVE-2026-26483

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...

EUVD-2026-46047

ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...

Important: Red Hat Security Advisory: Red Hat Migration Toolkit for Containers

A new version of Migration Toolkit for Containers MTC is now available. The Migration Toolkit for Containers MTC enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the...

MAL-2026-10832 Malicious code in @gocortexio/npmgremlinbox-malware-c2-beacon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6da5e787cb37cd00670a6df8b8489fd71e5c54b8af2216948669be4a0480f428 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10808 Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-3-0-de (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89b99be8fcb87a9c06989edb3b62e804fa2ebea83cd48b65eeac6b57f1636629 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...