CVE Watch8 sept 2026

CVE-2026-55785

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication co

CVSS

3.7

Bajo

EPSS

0.4%

p39

KEV

—

Exploit Today

0-100

Publicado: 28 ago 2026 · Última mod.: 8 sept 2026 · CWE-208 · CWE-385 · CWE-532

EPSS · 30d

0.4%EPSS · 30 días0.4%

2026-10-092026-11-06

Descripción técnica

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1205485.3 MED

—

———The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow.6h CVE-2026-173227.1 ALT

—

———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.11h CVE-2026-171286.8 MED

—

———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files.11h CVE-2026-445195.1 MED

—

———liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, the ct_select function in src/kem/frodokem/external/util.c for the FrodoKEM-640, FrodoKEM-976, and FrodoKEM-1344 AES and SHAKE reference variants lacks a value barrier in the Fujisaki-Okamoto implicit-rejection path. When compiled with Clang 17 or later at an affected optimization level such as -Os, the compiler can emit a secret-dependent conditional load, causing the real and rejection secret paths to leave distinguishable cache residency after successful and failed decapsulation. A local attacker able to perform repeated cache-timing measurements may use this oracle as part of a private-key recovery attack. Default -O3 builds vectorize both source loads and do not exhibit the reported behavior, and the advisory does not report the same generated memory-access pattern in NTRU, NTRU-Prime, BIKE, HQC, Classic McEliece, Kyber, or the already-barriered ML-KEM implementation. This issue is fixed in version 0.16.0.18h CVE-2026-106019—

—

——0Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials. This issue affects C-CURE 9000, Victor: 3.20.19h CVE-2026-1233165.5 MED

—

——0In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs19h