Все CVE за последние шесть месяцев, обновляются ежедневно.

Показано 10 из 10

• КритическийCVE-2026-94456Оценка CVSS 9.122 сент. 2026 г.

  Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these c

  CWE-330CWE-338CWE-341
• СреднийCVE-2026-87913Оценка CVSS 5.910 сент. 2026 г.

  A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that arch

  CWE-283CWE-341
• СреднийCVE-2026-87912Оценка CVSS 5.910 сент. 2026 г.

  A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state

  CWE-283CWE-341
• НизкийCVE-2026-19565Оценка CVSS 3.723 авг. 2026 г.

  Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to

  CWE-341
• ВысокийCVE-2026-15571Оценка CVSS 7.318 авг. 2026 г.

  A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that

  CWE-341
• КритическийCVE-2026-38968Оценка CVSS 9.82 июл. 2026 г.

  ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can r

  CWE-341ntop ntopng
• ВысокийCVE-2026-36609Оценка CVSS 7.33 июн. 2026 г.

  Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows a

  CWE-327CWE-341
• КритическийCVE-2026-5081Оценка CVSS 9.16 мая 2026 г.

  Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID vari

  CWE-340CWE-341chorny apache\
• ВысокийCVE-2026-42365Оценка CVSS 8.64 мая 2026 г.

  A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP requests can lead to an authentication bypas. An attacker can bruteforce session cookies to trigger this vu

  CWE-341geovision gv-lpc2011_firmwaregeovision gv-lpc2011geovision gv-lpc2211_firmware
• ВысокийCVE-2026-40164Оценка CVSS 7.514 апр. 2026 г.

  jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisi

  CWE-328CWE-407CWE-341