Multiple IP-KVM Vulnerabilities

RISK EVALUATION Multiple KVM products GL-iNet GL-RM1, Angeet ES3 KVM, Sipeed NanoKVM, and JetKVM are affected by multiple vulnerabilities. The most severe of these vulnerabilities could allow a remote, unauthenticated attacker to take complete control of a vulnerable product. 2. RECOMMENDED...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient verification of user permissions in the redirects process. An attacker can gain unauthorized access to redirect records by editing a page without proper access controls. Remediation Upgrade...

CVE-2026-4202

The CVE-2026-4202 issue concerns the TYPO3 extension Redirect Tab (also reflected in Red Hat, Snyk, GHSA, OSV entries). The root cause is missing authorization verification in the redirects flow, allowing an authenticated user with limited privileges to access or edit redirects and potentially ex...

CVE-2026-4258

Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH...

SUSE CVE-2026-28498

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect OIDC ID Tokens. Specifically, the internal hash verification logic verifyhash...

SUSE CVE-2026-32627

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and setfollowlocationtrue, any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new...

sjcl 安全漏洞

sjcl is a deprecated JavaScript encryption library developed by bitwiseshiftleft. Sjcl has a security vulnerability, which stems from the lack of point-to-point verification in sjcl.ecc.basicKey.publicKey. This vulnerability could allow attackers to recover the victim’s ECDH private key by sendin...

PT-2026-25915

The GL-iNet Comet GL-RM1 KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the...

GL-iNet Comet 安全漏洞

GL-iNet Comet is a portable, multi-functional network device developed by GL-iNet Corporation in China. There is a security vulnerability in GL-iNet Comet, which stems from the lack of certificate verification during the initialization process when connecting to the GL-iNet site. This vulnerabili...

CVE-2026-3564: Improper Verification of Cryptographic Signature

A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently...

CVE-2026-32294: Insufficient Verification of Data Authenticity

JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification...

CVE-2026-4258: Improper Verification of Cryptographic Signature

Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH...

Fedora 45 : cpp-httplib (2026-06d1b46d1e)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-06d1b46d1e advisory. Automatic update for cpp-httplib-0.38.0-1.fc45. Changelog Tue Mar 17 2026 Petr Menk - 0.38.0-1 - Update to 0.38.0 rhbz2447261 Tue Mar 17 2026 Petr Menk -...

The vulnerability of PDF viewing and editing programs such as Acrobat DC and Acrobat Reader DC, particularly in versions like Acrobat 2024, stems from errors in verifying cryptographic signatures. This allows attackers to exploit these vulnerabilities to gain increased privileges.

The vulnerabilities of PDF viewing and editing programs such as Acrobat DC, Acrobat Reader DC, and Acrobat 2024 are related to errors in verifying the cryptographic signature. Exploiting these vulnerabilities can allow attackers to enhance their privileges...

A Longitudinal Study of Usability in Identity-Based Software Signing

Identity-based software signing tools aim to make software artifact provenance verifiable while reducing the operational burden of long-lived key management. However, there is limited cross-tool longitudinal evidence about which usability problems arise in practice and how those problems evolve a...

PT-2026-26148

Name of the Vulnerable Software and Affected Versions Sliver versions 1.7.3 and below Description Sliver is a command and control framework that utilizes a custom Wireguard network stack. Versions 1.7.3 and below contain a Remote Out-of-Memory OOM issue in the mTLS and WireGuard C2 transport laye...

HCL Sametime 安全漏洞

HCL Sametime is a conference solution developed by the Indian company HCL. HCL Sametime has a security vulnerability, which stems from incomplete server-side verification. This vulnerability could allow attackers to bypass client input checks by sending manipulated HTTP requests directly to the...

GL-iNet Comet 安全漏洞

GL-iNet Comet is a portable, multi-functional network device developed by GL-iNet Corporation in China. There is a security vulnerability present in GL-iNet Comet, which stems from insufficient verification of the authenticity of uploaded firmware files. This vulnerability may allow intermediate...

PT-2026-25912

@securityweekly @anton chuvakin Good research. But about CVE-2026-32290 – GL-iNet Comet KVM insufficient verification of firmware authenticity… isn’t it the whole point of these devices that you could just run your own firmware opensource on it also? Like openwrt...

PT-2026-25954

CVE-2026-3856 IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integ… https://t.co/3y33wLJj0n...