golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate

A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service DoS for the affected system...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

CVE-2026-68426

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability arises when asynchronous cryptographic operations incorrectly handle network packet segments, leaving a pointer to memory that has already been released. An attacker could potentially exploit this use-after-free condition t...

Malicious code in dlmm-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ddf2d03d839f7eff709e78da1d6a85226cdd3b9171dbcb59a4a95c741e0773e The package's top-level module runs a report routine on import, and setup.py invokes the same import at install time. The routine collects environmen...

MAL-2026-13729 Malicious code in dlmm-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ddf2d03d839f7eff709e78da1d6a85226cdd3b9171dbcb59a4a95c741e0773e The package's top-level module runs a report routine on import, and setup.py invokes the same import at install time. The routine collects environmen...

PT-2026-70349

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description ColdFusion uses a broken or risky cryptographic algorithm, which could allow an attacker to disclose sensitive memory and information. This issue can be exploited without any user...

RHEL 10 : rhc (RHSA-2026:53374)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53374 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

Vitis™ Vulnerabilities

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-43606| Observable Timing Discrepancy in the Vitis™ Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagneti...

MAL-2026-13735 Malicious code in @aerodrome-finance/slipstream (npm)

@aerodrome-finance/slipstream is a malicious npm package that impersonates Aerodrome Finance's Slipstream concentrated-liquidity AMM. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall ru...

CVE-2025-30239

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...

Security Bulletin: Vulnerability in golang.org/x/crypto bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the golang.org/x/crypto library, which is affected by a denial of service vulnerability. CVE-2025-47914, CVE-2025-58181. Vulnerability Details CVEID:CVE-2025-47914 DESCRIPTION: SSH Agent servers do not validate the...

New turnkey kit makes it easy for anyone to become a scammer

In 2026, online scams have unfortunately become part of the new normal. They can appear almost anywhere, from social media and messaging apps to search results, websites, and online communities, and they can target anyone. Sometimes, all it takes is a moment of curiosity and a convincing offer...

CVE-2026-59112 Signature validation vulnerability affecting DigiDoc applications

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority RIA libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4:...

CVE-2026-68426

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...

AZL-95039 CVE-2026-68426 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...

CVE-2026-68426

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...

UBUNTU-CVE-2026-68426

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...

MAL-2026-13705 Malicious code in iconova-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4590534a7b05eb30959d9422e2ea700fb525b66b357a62f7ba1795caba4ad799 iconova-react is a re-hosted copy of lucide-react every icon file carries a @license lucide-react header; the package name is iconova-react but its...

CVE-2026-68426 xfrm: fix stale skb->prev after async crypto steals a GSO segment

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...