CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

The CVE-2026-71851 entry describes a vulnerability in crypto-js prior to 4.0.0 where CryptoJS.lib.WordArray.random() uses a non-cryptographically secure PRNG seeded from Math.random(), yielding only 2^39–2^47 entropy. This affects downstream wallets using that entropy for BIP39 recovery phrases, ...

CVE-2026-70561 TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...

CVE-2026-70561

TestLink 1.9.20 and earlier is affected by an insecure direct object reference in the attachmentdownload.php endpoint. An authenticated user, including low-privilege guests, can read arbitrary attachments by supplying any integer attachment ID, bypassing per-project access checks. Attackers can e...

CVE-2026-54200

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user....

CVE-2026-54200

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user....

CVE-2026-54200 TeamDavid: Local File Inclusion via the form field 'scjob'

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user....

Node.js Module Undici 7.x < 7.29.0 / 8.x < 8.9.0 Information Disclosure

The nodejs module Undici detected on the host is version 7.x prior to 7.29.0 or 8.x prior to 8.9.0. It is, therefore, affected by a vulnerability: - undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, ...

HPESBNW05119 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking Private 5G Core

Potential Security Impact: Remote: Access Restriction Bypass, Authentication Bypass, Escalation of Privilege, Gain Unauthorized Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Aruba Networking Private 5G Core 1.26.1.2 and prior CVSS Scores: | CVE | CVSS Vector | Base...

CVE-2026-62857

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo follows an attacker-controlled links.href value from /.well-known/nodeinfo without scheme, redirect, o...

CVE-2026-48076

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-48078

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...

CVE-2026-47185 Frappe Has Broken Access Control in its Workspace Save API

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...

CVE-2026-47185 Frappe Has Broken Access Control in its Workspace Save API

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...

CVE-2026-47185

CVE-2026-47185 — Frappe Workspace Save API : In Frappe, prior to version 16.18.0, the Workspace Save API accepted a controlled workspace identifier from any authenticated user without enforcing workspace ownership, enabling modification of another user’s private workspace and risking persistent s...

CVE-2026-62857

Fedify: Server-Side Request Forgery via getNodeInfo() is caused by following attacker-controlled links[].href from /.well-known/nodeinfo without scheme/redirect/private-address validation. Affected: Fedify versions 1.2.0 through 1.9, 1.10, 2.0, 2.1, 2.2, 2.3 maintenance lines. Impact: may access ...

CVE-2026-62857 Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo follows an attacker-controlled links.href value from /.well-known/nodeinfo without scheme, redirect, o...

CVE-2026-48078

OpenReception’s CVE-2026-48078 affects the scheduling endpoint prior to version 1.0.5. The unauthenticated /api/tenants/{id}/schedule endpoint exposed all non-archived channels for a tenant, including those with isPublic = false, disclosing channel names, descriptions, IDs, agent associations, pa...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...