Postiz-app versions before 2.4.0 generate security-sensitive credentials using a non-cryptographically secure pseudorandom number generator (Math.random()), exposing OAuth tokens and keys to compromise. An unauthenticated OAuth dynamic client registration endpoint leaks client credentials, enabling attackers to reconstruct the PRNG internal state and predict past and future credentials. This vulnerability has a critical severity with a CVSS score of 9.1.
A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
To remediate this issue, users should upgrade to version 0.2.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.
CVE-2026-87912 is a vulnerability in the AWS Security Agent plugin before version 1.1.0 where missing verification of S3 bucket ownership could allow remote attackers to access private source archives of scanned workspaces. These archives may contain sensitive credentials and infrastructure state. The issue arises from the use of a pre-registered storage bucket named based on a publicly known account identifier. AWS has released version 1.1.0 to address this vulnerability. Users must also verify that their scan output buckets are owned by their own accounts, as upgrading does not reclaim bucket names already registered by third parties.
Apache::AppSamurai::Util versions through 1.01 for Perl generate session authentication keys in a predictable manner using the system clock and process ID. This predictability allows an attacker who knows the session creation time and process ID to enumerate possible keys and potentially bypass authentication by recovering the victim's session cookie. The vulnerability has a low CVSS score and does not affect confidentiality, integrity, or availability beyond limited information disclosure.
CVE-2026-15571 is a vulnerability in the legacy client-initiated account-linking endpoint of Red Hat build of Keycloak 26.6. The flaw allows a malicious OpenID Connect (OIDC) client to predict the hash used to protect the account-linking process. By tricking a user into authenticating, the attacker can forge a valid linking URL, linking the victim's account to an attacker-controlled external identity, resulting in full account takeover.
A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP requests can lead to an authentication bypas. An attacker can bruteforce session cookies to trigger this vulnerability.
jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.
This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time, the attacker could determine a desired identifier which could enable them to access limited system information. This poses a low risk to confidentiality without impacting the integrity or availability of the service.