EUVD-2026-65482

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a...

Heap Buffer Overflow in CMS Key Unwrapping

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a...

CVE-2026-58085 Missing MAC validation in wg(4) packet decryption

After dispatching a decrypt operation to OCF and receiving the result, the wg4 driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag. A remote attacker who can send UDP packets to a WireGuard...

CVE-2026-4937: Insufficient Entropy

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested...

CVE-2026-72490

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

EUVD-2026-59389

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

CVE-2026-72490

The CVE-2026-72490 entry concerns the Linux kernel (staging: rtl8723bs) with a fix to the stainfo check in rtw_aes_decrypt. The issue was an incorrect null-pointer guard that returned _FAIL on a valid pointer; the guard was inverted so that it now returns _FAIL on invalid pointers. This change re...

CVE-2026-72490 staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

PT-2026-72678

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtw aes decrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

Security Bulletin:Vulnerability in OpenSSL affects IBM Netezza Appliance

Summary The OpenSSL package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-42768 Vulnerability Details CVEID:CVE-2026-42768 DESCRIPTION: Issue summary: The CMSdecrypt and PKCS7decrypt functions are vulnerable to Bleichenbacher-style attack when a...

CVE-2026-57262: Use of Hard-coded Cryptographic Key

A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...

UBUNTU-CVE-2026-68125

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsecdodecryptauth computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC...

CVE-2025-30239: Use of Hard-coded Cryptographic Key

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...

MAL-2026-13461 Malicious code in supersig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f8e62aa65bb4fe5e96a52cf6c5ba83c2f1bcf47eca3027bf4daca071249e5 The published dist bundles dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js, reached via the package's main/module/browser entries on...

PT-2026-68750

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.4 Description An authentication bypass exists in the appointment booking platform that allows unauthenticated network attackers to register themselves as encryption recipients for any tenant's future patient...

MAL-2026-12369 Malicious code in elephant-array-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2cfcddc59bba26e90415bf89488d4a814e5c1db07091da5e46b07f7727e49bb index.js is a heavily obfuscated obfuscator.io: rotated string array + RC4 decoder, control-flow flattening, hex literals top-level IIFE with no...

Malicious code in elephant-array-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2cfcddc59bba26e90415bf89488d4a814e5c1db07091da5e46b07f7727e49bb index.js is a heavily obfuscated obfuscator.io: rotated string array + RC4 decoder, control-flow flattening, hex literals top-level IIFE with no...

The vulnerabilities of the functions pkcs7_decrypt_smime(), pkcs7_decrypt_pem(), and pkcs7_decrypt_der in the Python programming language-based cryptography library allow attackers to compromise the confidentiality of protected information.

The vulnerabilities of the functions pkcs7decryptsmime, pkcs7decryptpem, and pkcs7decryptder in the Python programming language-based cryptography library are related to deficiencies in the error reporting mechanism. Exploiting these vulnerabilities could allow an attacker to influence the...

Malicious code in @tuluax/errb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561541f6fdbe9bd25716c6fb8a3326df9cbe7a78e7c972d89e36a1c9afc7a186 package.json scripts.install runs node -e "require'childprocess'.spawn'node', 'index.js', detached: true, stdio: 'ignore' .unref", causing npm instal...

Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext

A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman ECDH ciphertext to the gcrypkdecrypt function. This can lead to a heap-based buffer overflow, potentially causing a denial of service DoS condition...