69 matches found
CVE-2026-110926
A security flaw exists in OpenSSH where channels on the same connection share a single LZ77 dictionary when compression is negotiated. This allows a peer capable of writing to one channel to recover plaintext from another channel by utilizing chosen-plaintext lengths . No specific exploit details...
CVE-2026-110926
...
openssh: openssh: shared LZ77 compression dictionary leaks plaintext across channels
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths...
CVE-2026-15890 AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization
The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...
CVE-2026-15890 AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization
The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...
CVE-2026-15890
CVE-2026-15890 affects the Zephyr RTOS PSA Internal Trusted Storage (ITS) transform module. The default AEAD nonce provider (secure_storage_its_transform_aead_get_nonce) stores its nonce counter in unsynchronized function-local static variables. Two concurrent threads writing the same entry UID c...
CVE-2026-87732
An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...
CVE-2026-85171 n8n before 1.123.73 Credential Exposure via Error Logging
n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to...
EUVD-2026-68282
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...
CVE-2026-81322
CVE-2026-81322 is an information disclosure vulnerability in ash-project ash_cloak (versions 0.1.0 through before 0.4.0). The root cause is in AshCloak.Transformers.SetUpEncryption, which creates an action argument carrying the plaintext value of a cloaked attribute. This argument inherits the se...
CVE-2026-81322 Cloaked plaintext leaks through a non-sensitive action argument in AshCloak
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...
TencentOS Server 4: bouncycastle (TSSA-2026:0825)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0825 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
Security update for bouncycastle
This update for bouncycastle fixes the following issues: CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI bsc1272700. CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check bsc1272701. CVE-2026-12802: CMS AuthEnvelopedData fails to...
CVE-2026-58061
CVE-2026-58061 affects Bouncy Castle for Java: CCM-family modes may write plaintext to the caller buffer before tag verification. Affected are BC Java before 1.85, Java LTS before 2.73.12, and BC-FJA before bc-fips 1.0.2.7 (1.0.x), 2.0.2 (2.0.x), and 2.1.3 (2.1.x). Exploitation is network-based; ...
Linux Distros Unpatched Vulnerability : CVE-2026-58061
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS...
CVE-2026-58061: Improper Validation of Integrity Check Value
In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...
CVE-2026-25146 OpenEMR's payments gateway_api_key secret rendered into client JS code
OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are at least two paths where the gatewayapikey secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary...
CVE-2025-63361
Waveshare RS232/485 TO WIFI ETH B Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the Administrator password in plaintext...