CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

CVE-2026-16615

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

DEBIAN-CVE-2026-16615

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

EUVD-2026-47742

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

CVE-2026-16615 Librest: weak random number generation in pkce implementation

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

CVE-2026-16615

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

CVE-2026-11622

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

ALPINE-CVE-2026-11622

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

CVE-2026-11622

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

CVE-2026-11622 Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

PT-2026-63416

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description A DNSSEC validating...

PT-2026-63509

Name of the Vulnerable Software and Affected Versions Joomla Extension - regularlabs.com - IP login extension affected versions not specified Description The IP login extension generates persistent URL login keys using a non-cryptographic random generator with insufficient entropy, which can lead...

PT-2026-63433

Name of the Vulnerable Software and Affected Versions librest affected versions not specified Description The PKCE implementation for OAuth authorization uses the g rand function from the GLib API, which is a cryptographically insecure pseudo-random number generator PRNG. Due to insufficient...

kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc

A flaw was found in the Linux kernel's crypto AFALG subsystem. Memory allocated via sockkmalloc for crypto user API contexts is not zero-initialized, leaving fields with garbage values. Specifically, the 'inflight' variable can contain random data, causing afalgallocareq to spuriously return -EBU...

SUSE CVE-2026-63936

In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358readimp In mt6358readimp, the variable valv is passed to regmapread but the return value is not checked. If the read fails, valv remains uninitialized and its random stack...

CVE-2026-8169

ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...

CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...