CVE-2026-111065 vulnerabilities

Vulnerabilities for packages: metaflow-service, commercial-gitlab-cng-ee, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, litellm-fips, kserve...

CVE-2026-111748 vulnerabilities

Vulnerabilities for packages: metaflow-service, commercial-gitlab-cng-ee, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, litellm-fips, kserve...

CVE-2026-111749 vulnerabilities

Vulnerabilities for packages: metaflow-service, commercial-gitlab-cng-ee, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, litellm-fips, kserve...

CVE-2026-111750 vulnerabilities

Vulnerabilities for packages: metaflow-service, commercial-gitlab-cng-ee, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, litellm-fips, kserve...

GHSA-9XW5-W5JJ-PVCG vulnerabilities

Vulnerabilities for packages: metaflow-service, commercial-gitlab-cng-ee, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, litellm-fips, kserve...

GHSA-F9XW-JH8M-3MWQ vulnerabilities

Vulnerabilities for packages: metaflow-service, commercial-gitlab-cng-ee, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, litellm-fips, kserve...

Scalar-Venom-Attack

This paper analyzes cryptographic vulnerabilities discovered in modern cryptographic key management infrastructure, with a particular focus on critical flaws in the architecture of hardware security modules HSMs when handling elliptic curve private keys. The study focuses on a class of attacks th...

CVE-2026-61845 vulnerabilities

Vulnerabilities for packages: pghero-fips, pghero...

GHSA-6WMF-3R64-VCWV vulnerabilities

Vulnerabilities for packages: pghero-fips, pghero...

CVE-2020-3996 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-alicloud, velero-plugin-for-alicloud-fips...

CLEANSTART-2026-EH67735 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

Security vulnerability affects the coredns-fips package. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption...

GO-2026-6770 vulnerabilities

Vulnerabilities for packages: prometheus-podman-exporter, falco-no-driver, prometheus-podman-exporter-fips...

GO-2026-6700 vulnerabilities

Vulnerabilities for packages: bento, falcosidekick, krakend-fips, trufflehog, trufflehog-fips, krakend, falcosidekick-fips, keda-fips, guac, dapr-fips, keda, argo-events-fips, argo-events, dapr, telegraf, bento-fips...

CVE-2026-74048

A flaw was found in Apache Tomcat. When the server is configured to enforce FIPS Federal Information Processing Standards mode, a failure during FIPS activation causes Tomcat to log an error and continue running with standard non-FIPS cryptographic providers instead of terminating securely. This...

CVE-2026-87795 vulnerabilities

Vulnerabilities for packages: cassandra, cassandra-fips...

GHSA-VC57-7FRC-7VQX vulnerabilities

Vulnerabilities for packages: cassandra, cassandra-fips...

CVE-2026-74048

Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...

EUVD-2026-105004

Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...

CVE-2026-74048

Apache Tomcat contains a Not Failing Securely ('Failing Open') vulnerability where the OpenSSLLifecycleListener fails to prevent start-up if FIPS activation fails. When configured for FIPS mode but activation fails, the software logs an error but continues to operate using JSSE in non-FIPS mode ....

CVE-2026-74048 Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...