CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-34929

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

PUBLISHED

Vendor: Trend Micro, Inc., Trend Micro, Inc.
Product: TrendAI Apex One as a Service, TrendAI Apex One
Provider severity: HIGH
Conflicts: 1

CVE-2026-34928

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different named pipe communication mechanism. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

PUBLISHED

Vendor: Trend Micro, Inc., Trend Micro, Inc.
Product: TrendAI Apex One as a Service, TrendAI Apex One
Provider severity: HIGH
Conflicts: 1

CVE-2026-34927

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

PUBLISHED

Vendor: Trend Micro, Inc., Trend Micro, Inc.
Product: TrendAI Apex One as a Service, TrendAI Apex One
Provider severity: HIGH
Conflicts: 1

CVE-2026-34926

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

PUBLISHEDCISA KEV

Vendor: Trend Micro, Inc., Trend Micro, Inc.
Product: TrendAI Apex One as a Service, TrendAI Apex One
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-3492

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound failure involving missing authorization on the `create_from_template` AJAX endpoint (allowing any authenticated user to create forms), insufficient input sanitization (`sanitize_text_field()` preserves single quotes), and missing output escaping when the form title is rendered in the Form Switcher dropdown (`title` attribute constructed wit

PUBLISHED

Vendor: Gravity Forms
Product: Gravity Forms
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34917

Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users. An attacker could leverage this to gain unauthorised access and exploit API‑level vulnerabilities. The session context (web/API) is now recorded along with other session data, preventing session IDs from being used interchangeably.

PUBLISHED

Vendor: Revive
Product: Adserver
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34916

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated.

PUBLISHED

Vendor: Revive Adserver
Product: Revive Adserver
Provider severity: HIGH
Conflicts: 0

CVE-2026-34915

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.

PUBLISHED

Vendor: Revive
Product: Adserver
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34914

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.

PUBLISHED

Vendor: Revive
Product: Adserver
Provider severity: HIGH
Conflicts: 0

CVE-2026-34913

A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to link their trackers to campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that campaigns can only be linked to trackers owned by the same advertiser.

PUBLISHED

Vendor: Revive
Product: Adserver
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34912

A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its API allows a low‑privileged user could link their zones to banners or campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that banners and campaigns can only be linked to zones managed by the same account.

PUBLISHED

Vendor: Revive
Product: Adserver
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34911

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.

PUBLISHED

Vendor: Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc
Product: UDW, UNAS-4, UCK-Enterprise, UNAS-Pro, EFG, UCG-Fiber, UDM, UCG-Max, Express 7, ENVR, ENVR-Core, UCG-Ultra, UNVR-G2, UNVR, UNAS-Pro-4, UDM-Beast, UCG-Industrial, UDR7, UDR, UDM-Pro, UNVR-Instant, UCKP, UDM-Pro-Max, UNAS-2, UCK, UNVR-Pro, UniFi OS Server, UNVR-G2-Pro, UDM-SE, UNAS-Pro-8, UDR-5G
Provider severity: HIGH
Conflicts: 1

CVE-2026-34910

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

PUBLISHEDCISA KEV

Vendor: Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc
Product: UNVR-Pro, UCK, UCG-Max, UNAS-Pro, UDM, UDM-Pro-Max, UNVR-G2-Pro, UDR7, UCG-Ultra, UDM-Beast, UNAS-2, UCG-Industrial, UNVR-G2, UDR-5G, UDM-Pro, ENVR, UNVR, UCKP, UDR, UniFi OS Server, UNAS-4, UNAS-Pro-4, EFG, ENVR-Core, Express 7, UCK-Enterprise, UNAS-Pro-8, UDW, UNVR-Instant, UCG-Fiber, UDM-SE
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-34909

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

PUBLISHEDCISA KEV

Vendor: Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc
Product: UDW, ENVR, UCG-Fiber, Express, UNAS-Pro-8, UDR, UNVR-Pro, UCKP, EFG, UCG-Industrial, UCK, UDM-Pro, UNVR-Instant, UDM-Beast, Express 7, UNAS-Pro-4, UniFi OS Server, UCG-Max, ENVR-Core, UNVR, UDM-SE, UNAS-4, UDM, UCK-Enterprise, UNAS-Pro, UDR-5G, UNVR-G2-Pro, UNAS-2, UDM-Pro-Max, UCG-Ultra, UNVR-G2, UDR7
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-34908

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

PUBLISHEDCISA KEV

Vendor: Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc, Ubiquiti Inc
Product: UNAS-Pro-4, UDR7, UDM, UNVR-Pro, UNAS-Pro, EFG, UDM-Pro-Max, ENVR, UDM-Pro, UNVR-G2-Pro, UniFi OS Server, UNAS-Pro-8, UDM-SE, UCKP, UCG-Industrial, UNVR-Instant, UDR, UNAS-4, UDM-Beast, UCK, UNAS-2, UDR-5G, Express 7, ENVR-Core, UCG-Fiber, UCG-Ultra, UCK-Enterprise, UNVR-G2, UDW, UNVR, UCG-Max
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-34907

Wirtualna Uczelnia is vulnerable to Reflected Cross‑Site Scripting (XSS) due to insecure handling of the locale parameter across multiple endpoints. An attacker can craft a malicious URL with JavaScript embedded in the locale parameter and send it to a victim. When the victim opens the link, the injected script will be executed in their browser. This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

PUBLISHED

Vendor: Simple SA
Product: Wirtualna Uczelnia
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34906

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell. This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20

PUBLISHED

Vendor: Simple SA
Product: Wirtualna Uczelnia
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-34905

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted question feature did not enforce access restrictions on direct API endpoints, allowing authenticated users to discover and access unlisted questions, their answers, comments, and revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Answer
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34904

Cross-Site Request Forgery (CSRF) vulnerability in Analytify Simple Social Media Share Buttons allows Cross Site Request Forgery.This issue affects Simple Social Media Share Buttons: from n/a through 6.2.0.

PUBLISHED

Vendor: Analytify
Product: Simple Social Media Share Buttons
Provider severity: HIGH
Conflicts: 0

CVE-2026-34903

Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3.

PUBLISHED

Vendor: OceanWP
Product: Ocean Extra
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34902

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.

PUBLISHED

Vendor: WC Product Table
Product: WooCommerce Product Table Lite
Provider severity: HIGH
Conflicts: 0

CVE-2026-34901

Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.

PUBLISHED

Vendor: Paul
Product: iControlWP
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-34900

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.

PUBLISHED

Vendor: Liquid Web / StellarWP
Product: GiveWP
Provider severity: HIGH
Conflicts: 0

CVE-2026-3490

picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls. Remote attackers can invoke any blocked function such as os.system, builtins.exec, or subprocess.call to achieve remote code execution.

PUBLISHED

Vendor: picklescan
Product: picklescan
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-34899

Missing Authorization vulnerability in Eniture technology LTL Freight Quotes – Worldwide Express Edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through 5.2.1.

PUBLISHED

Vendor: Eniture technology
Product: LTL Freight Quotes – Worldwide Express Edition
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34898

Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.

PUBLISHED

Vendor: WP Swings
Product: Event Tickets Manager for WooCommerce
Provider severity: HIGH
Conflicts: 0

CVE-2026-34897

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.34.

PUBLISHED

Vendor: David Lingren
Product: Media LIbrary Assistant
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34896

Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, Coming Soon & Maintenance Mode allows Cross Site Request Forgery.This issue affects Under Construction, Coming Soon & Maintenance Mode: from n/a through 2.1.1.

PUBLISHED

Vendor: Analytify
Product: Under Construction, Coming Soon & Maintenance Mode
Provider severity: HIGH
Conflicts: 0

CVE-2026-34895

Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions.

PUBLISHED

Vendor: WebGeniusLab
Product: Softlab Core
Provider severity: HIGH
Conflicts: 0

CVE-2026-34894

Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.

PUBLISHED

Vendor: WebGeniusLab
Product: Integrio Core
Provider severity: HIGH
Conflicts: 0

CVE-2026-34893

Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.

PUBLISHED

Vendor: WebGeniusLab
Product: Thegov Core
Provider severity: HIGH
Conflicts: 0

CVE-2026-34892

Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.

PUBLISHED

Vendor: Rank Math SEO
Product: Rank Math SEO
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34891

Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions.

PUBLISHED

Vendor: IDPay
Product: IDPay Payment Gateway for Woocommerce
Provider severity: HIGH
Conflicts: 0

CVE-2026-34890

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O’Donnell MSTW League Manager allows DOM-Based XSS.This issue affects MSTW League Manager: from n/a through 2.10.

PUBLISHED

Vendor: Mark O’Donnell
Product: MSTW League Manager
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-3489

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PUBLISHED

Vendor: designinvento
Product: DirectoryPress – Business Directory And Classified Ad Listing
Provider severity: HIGH
Conflicts: 0

CVE-2026-34889

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows DOM-Based XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a before 3.21.4.

PUBLISHED

Vendor: Brainstorm Force
Product: Ultimate Addons for WPBakery Page Builder
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34888

Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions.

PUBLISHED

Vendor: Bricksforge
Product: Bricksforge
Provider severity: HIGH
Conflicts: 0

CVE-2026-34887

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder allows Stored XSS.This issue affects Kubio AI Page Builder: from n/a through 2.7.0.

PUBLISHED

Vendor: Extend Themes
Product: Kubio AI Page Builder
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34886

Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.

PUBLISHED

Vendor: wp.insider
Product: Simple Membership
Provider severity: HIGH
Conflicts: 0

CVE-2026-34885

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.34.

PUBLISHED

Vendor: David Lingren
Product: Media LIbrary Assistant
Provider severity: HIGH
Conflicts: 0

CVE-2026-34883

An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors. On Windows, a symbolic link vulnerability allows a local low-privileged user to escalate privileges to Administrator. During installation, the software writes the file CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ while running with elevated privileges. Because the installer does not properly validate symbolic links or reparse points at the destination path, an att

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-34881

OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.

PUBLISHED

Vendor: Red Hat, OpenStack, Red Hat, Red Hat
Product: Red Hat OpenStack Platform 18.0, Glance, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 16.2
Provider severity: HIGH, MEDIUM
Conflicts: 3

CVE-2026-3488

The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on multiple AJAX handlers including `wp_statistics_get_filters`, `wp_statistics_getPrivacyStatus`, `wp_statistics_updatePrivacyStatus`, and `wp_statistics_dismiss_notices`. These endpoints only verify a `wp_rest` nonce via `check_ajax_referer()` but do not enforce any capability checks such as `current_user_can()` or the plugin's ow

PUBLISHED

Vendor: veronalabs
Product: WP Statistics – Simple, privacy-friendly Google Analytics alternative
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-34877

An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-34876

An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized tag_len parameter. This is caused by missing validation of the tag_len parameter against the size of the internal 16-byte authentication buffer. The issue affects the public multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be invoked directl

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-34875

An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0. A buffer overflow can occur in public key export for FFDH keys.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-34874

An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-34873

An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while resuming a TLS 1.3 session.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-34872

An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input validation. Using finite-field Diffie-Hellman, the other party can force the shared secret into a small set of values (lack of contributory behavior). This is a problem for protocols that depend on contributory behavior (which is not the case for TLS). The attack can be carried by the peer, or depending on the protocol by an active networ

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-34871

An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1