CVE-2026-17274

CVE-2026-17274 affects the Debug Server component of IBM i versions 7.6, 7.5, 7.4, and 7.3. The vulnerability stems from predictable server seeds (CWE-330: Use of Insufficiently Random Values), allowing a remote authenticated attacker to bypass security restrictions with low complexity over the n...

CVE-2026-17274 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds...

CVE-2026-75431

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

EUVD-2026-70905

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled...

PT-2026-85685

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

CVE-2026-17274: Use of Insufficiently Random Values

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds...

PT-2026-85759

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds...

CVE-2026-75431

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

CVE-2026-75431

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

EUVD-2026-71448

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

CVE-2026-75431

PowerJob Server version 5.1.2 (and likely earlier) suffers from a predictable JWT signing key used for HS256-based authentication, allowing a remote attacker with no prior access to forge valid tokens and execute arbitrary code . The vulnerability is rated CVSS 9.1 (Critical) with high confidenti...

GHSA-FPH4-WMHF-6FWF vulnerabilities

Vulnerabilities for packages: tileserver-gl, yaml-language-server, prism, argo-workflows, vitess, opensearch-dashboards...

CVE-2026-85028

CVE-2026-85028 affects the FPGA management tool installation component of AWS FPGA Development Kit (aws-fpga) prior to version 2.3.4 . The root cause is the creation of a temporary file in a world-writable directory with insecure permissions. A local attacker with low privileges can place crafted...

CVE-2026-85028 Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...

CVE-2026-3416 Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

CVE-2026-3416

WSO2 products' API Publisher component used a non-cryptographic pseudorandom number generator (PRNG) to generate shared secrets for Webhook HMAC validation. Because the PRNG lacks sufficient entropy, a sophisticated attacker can predict future secrets and forge event payloads with valid HMAC sign...

SUSE-SU-2026:3929-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...

CVE-2026-85028: Creation of Temporary File in Directory with Insecure Permissions

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...

Improper Input Validation

nanoid is vulnerable to Improper Input Validation. The vulnerability is due to improper coercion of the user-influenced size parameter to a signed 32-bit integer, which allows an attacker to corrupt the process-wide CSPRNG pool and cause subsequent tokens and unique identifiers to become...

CVE-2026-73778

A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator has configured credentials by providi...