Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...

CVE-2026-16957

The CVE describes a vulnerability in the Slim SEO WordPress plugin (pre-4.9.11) where a post-meta preview feature does not properly restrict access to posts a user can edit; it only checks read permission. As a result, users with the Contributor role (and higher) can read arbitrary post meta, inc...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Summary CryptoJS.lib.WordArray.random in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware...

CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-53976

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

EUVD-2026-53936

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

CVE-2026-53976 OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

Authentication Bypass

github.com/envoyproxy/gateway is vulnerable to Authentication Bypass. The vulnerability is due to missing authentication checks for unary xDS RPCs and improper JWT validation for State-of-the-World discovery requests, which allows an attacker with network access to the xDS server to bypass...

MAL-2026-11720 Malicious code in @or-sdk/pgsql (npm)

npm/@or-sdk/pgsql is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

CVE-2026-10774

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, netkeyscreate imports the Private Beacon Key into a PSA key slot under CONFIGBTMESHPRIVBEACONS enabled by default, but subnetkeysdestroy guarded the matchin...

Debug output exposes NIP-46 and NIP-60 credentials

Several NIP-46 and NIP-60 types used derived Debug implementations even though their fields contained credentials or decrypted application data. Formatting these values exposed NIP-46 connection secrets and request parameters, as well as NIP-60 private keys, Cashu bearer proofs, and quote...

EUVD-2026-51313

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the...

CVE-2026-68562

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and cop...

CVE-2026-68562 Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and cop...

CVE-2026-5846

The CVE-2026-5846 entry concerns Watchfire Controller Software, where self-signed hard-coded RSA private keys and X.509 certificates are embedded in plaintext in the firmware patch binaries from Watchfire’s Remote Support filestore. This exposes TLS/HTTPS authentication and encryption for the con...

CVE-2026-5846 Hard-coded Cryptographic Key in Watchfire Controllers

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the...