CVE-2026-22863 Deno node:crypto doesn't finalize cipher

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server...

CVE-2026-23519

The CVE-2026-23519 entry describes RustCrypto CMOV, which provides conditional move CPU intrinsics. The vulnerability concerns the thumbv6m-none-eabi target (Cortex-M0, M0+, M1) where the compiler emitted non-constant-time assembly for cmovnz prior to version 0.4.4. The issue affects how conditio...

CVE-2026-23519

RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. Prior to 0.4.4, the thumbv6m-none-eabi Cortex M0, M0+ and M1 compiler emits non-constant time assembly when using cmovnz...

Security Bulletin: A security vulnerability in WebSphere Liberty affects IBM Robotic Process Automation for Cloud Pak (CVE-2020-36732).

Summary A security vulnerability in WebSphere Liberty affects IBM Robotic Process Automation for Cloud Pak. WebSphere Application Liberty is used by IBM Robotic Process Automation as part of Antivirus and Abbyy containers as well as UMS. This bulletin identifies the fixes required to address this...

RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`

Summary thumbv6m-none-eabi Cortex M0, M0+ and M1 compiler emits non-constant time assembly when using cmovnz portable version. I did not found any other target with the same behaviour but I did not go through all targets supported by Rust. Details It seems that, during mask computation, an LLVM...

SUSE-SU-2026:20089-1 Security update for alloy

This update for alloy fixes the following issues: Upgrade to version 1.12.1. Security issues fixed: - CVE-2025-47911: golang.org/x/net/html: quadratic complexity algorithms used when parsing untrusted HTML documents bsc1251509. - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption...

SUSE-SU-2026:20244-1 Security update for elemental-toolkit, elemental-operator

This update for elemental-toolkit, elemental-operator fixes the following issues: elemental-operator: - Update to version 1.6.10: Remove 'latest' tag as this overlaps with the latest branch Bump github.com/rancher-sandbox/go-tpm and its dependencies This bump includes fixes to some CVEs: bsc12418...

RLSA-2026:0436 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

RLSA-2026:0437 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003425)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003425 advisory. crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AFALG-based AEAD interface...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002727)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002727 advisory. An issue was discovered in the Linux kernel before 4.19.3. cryptoreportone and related functions in crypto/cryptouser.c the crypto user configuration API do not full...

Deno security vulnerabilities

Deno is a simple, modern, and secure JavaScript and TypeScript runtime environment developed by Deno itself. Versions of Deno prior to 2.6.0 contained a security vulnerability caused by node:crypto failing to perform password encryption properly, which could lead to infinite encryption attacks...

PT-2026-3145

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.6.0 Description Deno is a JavaScript, TypeScript, and WebAssembly runtime. A flaw in the node:crypto polyfill allows cryptographic handles to persist beyond their intended lifespan. This results in the possibility of...

RustCrypto security vulnerabilities

RustCrypto is an open-source authentication encryption algorithm with associated data algorithms developed by RustCrypto. Versions of RustCrypto prior to 0.4.4 contained security vulnerabilities, which were caused by the compiler generating non-constant-time assembly code...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003375)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003375 advisory. Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service NULL pointer dereference or possibly gai...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002190)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002190 advisory. The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIGVMAPSTACK option, which allows local users to cause a denial o...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002815)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002815 advisory. A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The null skcipher was being dropped when each afalgctx was freed instead...

Oracle Linux 9 : net-snmp (ELSA-2026-0696)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-0696 advisory. 5.9.1-17.0.1.1 - fix error index value when snmpget is used a proxy pass Orabug: 35010262 1:5.9.1-17.1 - fix out of bound access issue RHEL-137510 - enable PQC...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002210)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002210 advisory. crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service NULL pointer dereference and system crash by using an AFALG socket...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003138)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003138 advisory. The cryptoskcipherinittfm function in crypto/skcipher.c in the Linux kernel through 4.11.2 relies on a setkey function that lacks a key-size check, which allows loca...