modoboa 2.0.4 - Admin TakeOver

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...

WP Directory Kit <= 1.4.4 - Authentication Bypass

The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism tha...

ROOT-OS-UBUNTU-2204-CVE-2024-53240 CVE-2024-53240 in linux - Patched by Root

Root has patched CVE-2024-53240 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

PT-2026-79049

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

CVE-2026-4937

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested...

CVE-2026-4936

IBM PowerVM Hypervisor PKS and virtual TPM firmware (FW1110.00–.20, FW1060.00–.71, FW950.00–.H2) use weak persistent storage key seeds (CWE-331), allowing an attacker with service processor or HMC access to derive AES keys. Patch to FW1110.30, FW1060.72/80, or FW950.H3, then run sbmgr -regenerate...

CVE-2026-4937 Power System Insufficient Entropy

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested...

CVE-2026-74402

A flaw was found in the Linux kernel's atmel-sha204a cryptographic hardware random number generator HWRNG driver. Improper buffer management in both blocking and non-blocking paths causes the driver to fail in providing valid entropy. This occurs because the buffer is read starting from byte 1, a...

CVE-2026-60752

...

CVE-2026-55166

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acmeurl without an effective server-side destination restriction and trigger AcmeHandler.setupacmeclient to make backend requests. An attacker could target cloud instance metadata or...

http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

Impact An issue in DigestAuthProvider.verify: Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses...

CVE-2026-59650

A flaw was found in Bouncy Castle for Java. The software fails to validate Diffie-Hellman peer values during key agreement. A remote attacker can exploit this flaw to compromise cryptographic keys, potentially leading to the decryption of sensitive communications or successful impersonation...

EUVD-2026-60108

opensslencrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks...

CVE-2026-74887

openssl_encrypt before 1.4.0 imports Python's non-cryptographic random module (Mersenne Twister) in modules/pqc.py line 15. No current code calls random.*, so no crypto operation is actively affected, but the import creates a latent hazard: future code could accidentally use predictable PRNG outp...

Security Bulletin: This Power System update is being released to address CVE-2026-4936

Summary PowerVM Platform KeyStore PKS and virtual TPM use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data. Vulnerability Details...

Insecure Trusted-Package Validation

Spring for Apache Pulsar is vulnerable to an insecure trusted-package validation. The vulnerability is due to JsonPulsarHeaderMapper using a prefix-based check for trusted packages and treating an empty trusted-packages configuration as trusting all packages, which allows an attacker to potential...

CVE-2026-17616

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

CVE-2026-18536

A flaw was found in Data-Entropy. This component reads remote entropy randomness sources over unencrypted HTTP. An on-path attacker, such as one on an open Wi-Fi network or a compromised internet service provider ISP, can intercept and alter the responses from these sources. This allows the...

CVE-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

PT-2026-71094

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...