CVE-2026-85387

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly...

CVE-2026-87031

n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint POST /ccm/api/1.0/users, the add method of concrete/src/Api/Controller/Users.php did not perform a permission check before creating an account. As a result, any valid OAuth token carrying the users:add scope, including a...

CVE-2026-85387

Concrete CMS before 9.5.4 failed to re-check account state when validating OAuth bearer tokens for its REST API. The authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked — so deactivated , deleted , or locked (pending forced password re...

CVE-2026-85387 Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly...

EUVD-2026-80892

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly...

CVE-2026-18110

Concrete CMS 9 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to t...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: net/tls: The bug related to slab-out-of-bounds condition in decryptinternal has been fixed. The memory size of tlsctx-rx.iv for AES128-CCM is 12 bytes when tlssetswoffload is called. The return value of cryptoaeadivsize for...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2026-2153)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2153 advisory. In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross- nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-58061

A flaw was found in Bouncy Castle for Java. When using CCM-family Counter with CBC-MAC modes, the software writes plaintext data into a buffer before verifying the cryptographic tag. This could allow an attacker to manipulate data that is later assumed to be authentic, leading to a high integrity...

SUSE CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80882

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegraccmdoonereq...

CVE-2026-80882

This vulnerability affects the Linux kernel 's Tegra crypto driver , specifically the CCM (Counter with CBC-MAC) implementation in the function tegra_ccm_do_one_req. The root cause is that when the input buffer allocation fails, the ENOMEM error value is not properly set and returned, leading to ...

EUVD-2026-71512

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegraccmdoonereq...

CVE-2026-80882 crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegraccmdoonereq...

AZL-99567 CVE-2026-80832 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832

CVE-2026-80832 is a buffer underallocation flaw in the Linux kernel's QCE (Qualcomm Crypto Engine) crypto driver , specifically in qce_aead_ccm_prepare_buf_assoclen(). The AAD buffer size is computed as ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN, while the DMA scatterlist length uses ALIGN(as...

EUVD-2026-71282

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832 crypto: qce - fix CCM AAD buffer underallocation

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

Linux Distros Unpatched Vulnerability : CVE-2026-80832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into t...