CVE-2026-96222

Improper certificate validation in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2026-111330

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

CVE-2026-111330 JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

CVE-2026-111330

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

CVE-2026-111330 JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

CVE-2026-111330 JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

CVE-2026-111330

JuggleIM im-server versions through 1.8.16 are vulnerable to a weak password hashing vulnerability. The application uses unsalted SHA-1 digests (via tools.SHA1) to store admin console passwords in the services/accountservice.go component. If an attacker gains access to the accounts table through ...

CVE-2026-111323 RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

CVE-2026-111323

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

CVE-2026-111323 RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

EUVD-2026-102434

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime...

CVE-2026-58392

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...

Nord Security NordVPN Authorization Issue Vulnerability

Nord Security’s NordVPN versions prior to 8.12 have a vulnerability related to authorization. This vulnerability stems from improper access control in named pipes. A low-privilege attacker can connect to the named pipe “\.\pipe\nord-security\v1\NordVpnService\Server”, call the methods...

Tandoor Recipes: Server Request Forgery Vulnerability

Versions of Tandoor Recipes prior to 2.6.10 contained a server-side request forgeing vulnerability. This vulnerability stemmed from directly passing the URL of the AI provider controlled by administrators to LiteLLM, without applying Server Outbound Request SSRF protection. Identified users could...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: x86/EFI: The deferral of freeing boot services memory The efifreebootservices function frees the memory occupied by EFIBOOTSERVICESCODE and EFIBOOTSERVICESDATA using memblockfreelate. There are two issues with this approach:...

Astra Linux – Vulnerability in nss

During RSA key generation, bignum implementations used a variant of the Binary Extended Euclidean Algorithm, which involved significant input-dependent processes. This allowed attackers to perform electromagnetic-based side-channel attacks to capture traces that could lead to the recovery of secr...

Astra Linux – Vulnerability in Firefox, Thunderbird

Using techniques based on slipstream research, a malicious webpage could scan both the hosts of an internal network and the services running on the user’s local machine, using WebRTC connections. This vulnerability affects Firefox ESR 78.9, Firefox 87, and Thunderbird 78.9...

Astra Linux – Vulnerability in Flatpak

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak applications that had direct access to AFUNIX sockets—such as those used by Wayland, Pipewire, or pipewire-pulse—could trick portals and other host-...

Astra Linux – Vulnerability in the supervisor

In Supervisor version 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer confirmed that the affected component, inethttpserver, is not enabled by default. However, if the user enables it and does not set a password, Supervisor will log a warning message...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Calls boot services in mixed mode on the firmware’s stack Normally, the EFI stub calls into EFI boot services using the stack that was active when the stub was entered. According to the UEFI specification, this stack...