🚨 CVE-2026-74893
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.
🎖@cveNotify
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.
🎖@cveNotify
GitHub
Hardcoded default JWT secrets pass validation and enable token forgery
## Severity: CRITICAL
### Summary
The unified server's `config.py` at **lines 178-186** contains hardcoded default JWT signing secrets that pass the startup validation check (>= 32 charact...
### Summary
The unified server's `config.py` at **lines 178-186** contains hardcoded default JWT signing secrets that pass the startup validation check (>= 32 charact...
🚨 CVE-2026-74900
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.
🎖@cveNotify
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.
🎖@cveNotify
GitHub
PQC simulation mode fallback uses weak deterministic shared secret
## Severity: CRITICAL
### Summary
In `openssl_encrypt/modules/pqc.py` at **lines 1046-1138**, if KEM decapsulation fails for any reason, the code silently falls back to a "simulation mode&qu...
### Summary
In `openssl_encrypt/modules/pqc.py` at **lines 1046-1138**, if KEM decapsulation fails for any reason, the code silently falls back to a "simulation mode&qu...
🚨 CVE-2026-14564
Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data.
This issue affects Logsign SIEM: from 6.4.97 before 6.4.114.
🎖@cveNotify
Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data.
This issue affects Logsign SIEM: from 6.4.97 before 6.4.114.
🎖@cveNotify
siberguvenlik.gov.tr
T.C. Siber Güvenlik Başkanlığı
Türkiye Cumhuriyeti Cumhurbaşkanlığı Siber Güvenlik Başkanlığı resmi web sitesi.
🚨 CVE-2026-16467
Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Fortilogger: before 6.1.5.9.
🎖@cveNotify
Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Fortilogger: before 6.1.5.9.
🎖@cveNotify
siberguvenlik.gov.tr
T.C. Siber Güvenlik Başkanlığı
Türkiye Cumhuriyeti Cumhurbaşkanlığı Siber Güvenlik Başkanlığı resmi web sitesi.
🚨 CVE-2026-18674
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone.
The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide.
The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on.
🎖@cveNotify
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone.
The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide.
The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on.
🎖@cveNotify
Kong Docs
Kong Mesh changelog - Kong Mesh | Kong Docs
Changelog for supported Kong Mesh versions.
🚨 CVE-2026-70412
Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
🎖@cveNotify
Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
🎖@cveNotify
🚨 CVE-2026-74997
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.
🎖@cveNotify
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.
🎖@cveNotify
GitHub
Fix RCE via cmd_learn driver of markasjunk plugin · roundcube/roundcubemail@14044f8
The Roundcube Webmail suite. Contribute to roundcube/roundcubemail development by creating an account on GitHub.
🚨 CVE-2026-74998
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.
🎖@cveNotify
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.
🎖@cveNotify
GitHub
Add basic validation for content proxied by the css proxy · roundcube/roundcubemail@62d33c8
The Roundcube Webmail suite. Contribute to roundcube/roundcubemail development by creating an account on GitHub.
🚨 CVE-2026-74999
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.
🎖@cveNotify
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.
🎖@cveNotify
GitHub
Fix stored XSS in "Add to address book" action · roundcube/roundcubemail@2d2a960
The Roundcube Webmail suite. Contribute to roundcube/roundcubemail development by creating an account on GitHub.
🚨 CVE-2026-75000
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.
🎖@cveNotify
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.
🎖@cveNotify
GitHub
Release Roundcube Webmail 1.6.18 · roundcube/roundcubemail
This is a security update to the version 1.6 of Roundcube Webmail.
It provides fixes to recently reported security vulnerabilities:
Add basic validation for content proxied by the css proxy
Fix SS...
It provides fixes to recently reported security vulnerabilities:
Add basic validation for content proxied by the css proxy
Fix SS...
🚨 CVE-2026-75002
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.
🎖@cveNotify
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.
🎖@cveNotify
GitHub
Fix IMAP command injection via mail search and LITERAL+ byte-count de… · roundcube/roundcubemail@404d43f
…synchronization
🚨 CVE-2026-75004
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.
🎖@cveNotify
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.
🎖@cveNotify
GitHub
Release Roundcube Webmail 1.6.18 · roundcube/roundcubemail
This is a security update to the version 1.6 of Roundcube Webmail.
It provides fixes to recently reported security vulnerabilities:
Add basic validation for content proxied by the css proxy
Fix SS...
It provides fixes to recently reported security vulnerabilities:
Add basic validation for content proxied by the css proxy
Fix SS...
🚨 CVE-2026-75006
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.
🎖@cveNotify
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.
🎖@cveNotify
GitHub
Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 a… · roundcube/roundcubemail@7e10ca0
…nd fe80::/10 nets
🚨 CVE-2026-75007
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.
🎖@cveNotify
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.
🎖@cveNotify
GitHub
Fix LDAP filter injection via unescaped %u/%fu/%d substitution into t… · roundcube/roundcubemail@0893e19
…he `search_filter`
🚨 CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver.
🎖@cveNotify
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver.
🎖@cveNotify
GitHub
Fix password's modoboa driver leak of an authentication token to a us… · roundcube/roundcubemail@65b8ea9
…er-controlled host
🚨 CVE-2026-47487
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of service and information disclosure.
🎖@cveNotify
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of service and information disclosure.
🎖@cveNotify
GitHub
product-security/2026/5860 at main · NVIDIA/product-security
Starting October 1, 2025, NVIDIA PSIRT will publish an initial set of security bulletins on GitHub in Markdown, CSAF, and CVE formats. Coverage will expand over time, while all bulletins remain ava...
🚨 CVE-2026-65811
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
🎖@cveNotify
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66301
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-70339
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-17481
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
🎖@cveNotify
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
🎖@cveNotify
Ibm
Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server…
🚨 CVE-2026-17482
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
🎖@cveNotify
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
🎖@cveNotify
Ibm
Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server…