CVE-2026-27490

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3...

CVE-2026-27490 Combodo iTop: Weak secret generation for inline image

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3...

CVE-2026-53762

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

Use of a Broken or Risky Cryptographic Algorithm

Overview Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to the extractContextHash logic in SemanticCacheAdvisor.java. An attacker can receive cached responses from an unrelated system prompt by sending requests whose prompts collide under...

CVE-2026-27490: Insufficient Entropy

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3...

PT-2026-79443

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web based IT service management tool. Inline images that are accessible without authentication are protected by a weak 24-bit pseudo-random secret, which may allow unauthorized...

CVE-2026-77151

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an...

CVE-2026-77151

lin-snow Ech0 (versions up to 5.4.1 ) is affected by a cryptographic weakness in the MD5Encrypt function located in internal/util/crypto/crypto.go. The use of MD5 as a hashing algorithm is considered a risky cryptographic practice, as MD5 is known to be collision-prone and unsuitable for security...

CVE-2026-77151 lin-snow Ech0 crypto.go MD5Encrypt risky encryption

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an...

CVE-2026-77151 lin-snow Ech0 crypto.go MD5Encrypt risky encryption

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an...

CVE-2026-64964

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation...

CVE-2025-14602 Weak File Name Generation in vsDesk

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, whic...

CVE-2025-14602 Weak File Name Generation in vsDesk

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, whic...

CVE-2025-14602

vsDesk generates uploaded file names using a predictable timestamp-based method, allowing remote attackers to guess filenames and access uploaded files. Patched in version 14.0101; CVSS 4.0 scores it MEDIUM (5.3). No in-the-wild exploitation reported. Patch available from https://vsdesk.ru/. Advi...

pingtunnel master-a0d08ec7d44f4829c543416542ef3734453a4a55

Pingtunnel Pingtunnel is a tool that sends TCP/UDP traffic over ICMP. Note: This tool is only to be used for study and research, do not use it for illegal purposes Usage Install server First prepare a server with a public IP, such as EC2 on AWS, assuming the domain name or public IP is...

PT-2026-79012

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation...

PT-2026-79117

Name of the Vulnerable Software and Affected Versions lin-snow Ech0 versions prior to 5.4.2 Description A security flaw exists in the MD5Encrypt function within the internal/util/crypto/crypto.go file. This issue involves the use of a risky cryptographic algorithm, which could allow for remote...

cve-2026-59293 - MEDIUM - SMB minimum protocol dialect defaults to SMB1

cve-2026-59293 - MEDIUM - SMB minimum protocol dialect defaults to SMB1...

CVE-2026-4936

IBM PowerVM Hypervisor Platform KeyStore PKS and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could...

CVE-2026-75112

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...