PT-2026-71405

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

PT-2026-71751

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...

PT-2026-71776

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

CVE-2026-68397 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68397 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-63803 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-63803 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68333 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68333 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68277 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68277 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64275 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64275 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68315 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68315 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64323 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64323 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64444 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64444 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64298 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64298 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64580 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-64580 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64548 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64548 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-65370

The CVE-2026-65370 issue affects ServiceTalk HTTP/1.x where malformed Transfer-Encoding is not handled correctly, enabling request smuggling as described across multiple sources. The vulnerability is addressed in ServiceTalk release 0.42.65. Affected component: ServiceTalk HTTP/1.x parsing of Tra...

CVE-2026-65370

ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42.65...

EUVD-2026-57604

ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42.65...

EUVD-2026-57451

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

CVE-2026-73288

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...

CVE-2026-73285 RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...