CVE-2026-6726

The CVE concerns the TPM 2.0 reference code from the TCG. Affected component: TPM 2.0 reference implementation. Root cause/attack vector: information leakage could allow a local attacker with elevated privileges to obtain a credential from a TPM‑aware certificate authority for a falsified TPM key...

EUVD-2026-56224

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

CVE-2026-6726 An information leakage vulnerability in the TCG TPM 2.0 reference code.

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

CVE-2026-6727

Technical details are not publicly available in the provided documents; monitor for updates.

EUVD-2026-56223

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

CVE-2026-6727 CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse

CVE-2026-6726 is a Spoofing vulnerability in the TPM 2.0 reference implementation involving improper object-slot reuse. MITRE assigned this CVE on behalf of the Trusted Computing Group. This document incorporates updates to Microsoft Windows that address this vulnerability. Please see CVE-2026-67...

MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability

CVE-2026-6727 is an Information Disclosure vulnerability in the TPM 2.0 reference implementation involving an RSA OAEP timing side channel. MITRE assigned this CVE on behalf of the Trusted Computing Group. This document incorporates updates to Microsoft Windows that address this vulnerability...

TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

Overview Two vulnerabilities have been identified in the Trusted Platform Module TPM 2.0 reference implementation: 1. CVE-2026-6726 – Information leakage via falsified TPM keys. 2. CVE-2026-6727 – A timing side-channel vulnerability in RSA OAEP decryption. An attacker with privileged access to a...

PT-2026-70244

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may...

PT-2026-70243

Name of the Vulnerable Software and Affected Versions TCG TPM 2.0 reference code affected versions not specified Description An information leakage issue exists that allows a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key, such as an...

Trusted Platform Module (TPM) Reference Code Errata

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Score ---|---|--- CVE-2026-6726 non-AMD| An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a...

EulerOS 2.0 SP11 : python-sqlalchemy (EulerOS-SA-2026-3097)

According to the versions of the python-sqlalchemy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the .flatten and .isEqual functions use recursion without a...

EulerOS 2.0 SP11 : python-sqlalchemy (EulerOS-SA-2026-3151)

According to the versions of the python-sqlalchemy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the .flatten and .isEqual functions use recursion without a...

EulerOS 2.0 SP11 : python-pygments (EulerOS-SA-2026-3150)

According to the versions of the python-pygments packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file...

EulerOS 2.0 SP11 : bind (EulerOS-SA-2026-3058)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...

EulerOS 2.0 SP15 : bind (EulerOS-SA-2026-2875)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving a...

EulerOS 2.0 SP13 : python-idna (EulerOS-SA-2026-3039)

According to the versions of the python-idna package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and...

EulerOS 2.0 SP13 : httpd (EulerOS-SA-2026-2970)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are...

EulerOS 2.0 SP15 : python-pillow (EulerOS-SA-2026-2943)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow...