CVE-2026-103531

A stack-based buffer overflow vulnerability exists in OpenSC versions up to 0.27.1 . The flaw is located in the setcos_construct_fci_44 function within the src/libopensc/card-setcos.c file. Specifically, manipulating the type_attr argument can trigger the overflow. This vulnerability can be explo...

AlmaLinux 9.2 [TuxCare] Security Update: opensc (ALMALINUX9.2:CLSA-2025:1765902200)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765902200 advisory. - A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart...

AlmaLinux 9.6 [TuxCare] Security Update: opensc (ALMALINUX9.6:CLSA-2026:1781267272)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781267272 advisory. - OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in pivprocesshistory in...

AlmaLinux 9.6 [TuxCare] Security Update: opensc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778674879)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778674879 advisory. - A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. An attacker could use a crafted USB Device ...

Linux Distros Unpatched Vulnerability : CVE-2026-103531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcosconstructfci44 of the file src/libopensc/card-setcos.c. Executing a...

Rocky Linux 9.6 [TuxCare] Security Update: opensc (ALMALINUX9.6:CLSA-2026:1781267272)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781267272 advisory. - OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in pivprocesshistory in...

AlmaLinux 9.2 [TuxCare] Security Update: opensc (ALMALINUX9.2:CLSA-2025:1765382050)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765382050 advisory. - A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the syste...

Amazon Prime Phishing Scam Uses Fake Billing Alert to Steal Logins and Card Details

An Amazon Prime phishing campaign is using fake payment alerts to steal account logins, personal data and complete credit or debit card details from unsuspecting customers...

AlmaLinux 9.2 [TuxCare] Security Update: opensc (ALMALINUX9.2:CLSA-2026:1779101894)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779101894 advisory. - Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init wh...

CVE-2026-100641

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...

CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...

CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...

CVE-2026-100641

SiYuan versions before v3.8.4 are vulnerable to a Stored XSS flaw because they fail to HTML-escape stored flashcard block content. Specifically, content retrieved from the /api/riff/getRiffCards endpoint is inserted into app/src/card/viewCards.ts and assigned to listElement.innerHTML without prop...

EUVD-2026-87735

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...

CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...

Old-School Credit Card Scams Are Far From Dead

In an era of increasingly sophisticated AI-fueled scams, a retro threat may be lurking in your mailbox...

CVE-2026-100641: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...

PT-2026-99312

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Stored flashcard block content is not HTML-escaped before being interpolated into the card-manager list markup. Content returned by the '/api/riff/getRiffCards' endpoint is inserted into a template in...

Short Paper: Prefix Count Limits Can Increase First-Hit Discovery in Card Reissuance

When a card number is compromised, an attacker may search for active numbers sharing its prefix. An issuer might respond by reissuing cards from heavily populated prefixes into less populated ones. We show that this intuitive count control can backfire. For fixed search regions, exposure weights,...

CVE-2026-11744

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to t...