ECHO-996B-8212-C170

Bulletin has no description...

ECHO-0CB0-7DA1-3372

Bulletin has no description...

ECHO-9985-8562-093B

Bulletin has no description...

ECHO-9242-F571-8EA9

Bulletin has no description...

ECHO-6664-F962-30DF

Bulletin has no description...

ECHO-01C0-F5A2-A4A3

Bulletin has no description...

ECHO-A6E4-6DD5-0786

Bulletin has no description...

ECHO-B96F-D9BA-9F97

Bulletin has no description...

ECHO-7ADB-EC5B-8F9F

Bulletin has no description...

ECHO-13FC-89E5-6A1B

Bulletin has no description...

ECHO-ECFE-673E-E5C2

Bulletin has no description...

ECHO-FD03-FAF2-37AD

Bulletin has no description...

GHSA-XX3P-5M4J-RHW8 vulnerabilities

Vulnerabilities for packages: qemu...

GHSA-V3CW-2F3G-F38X vulnerabilities

Vulnerabilities for packages: expat...

GHSA-V9PM-V9P5-H96X vulnerabilities

Vulnerabilities for packages: qemu...

CVE-2026-7531

Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 released in 5.9.1: a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger the error cleanup path to operate on freed memory...

CVE-2026-12340

Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier computation reads the trailing 65 bytes of the public key without checking that the key is at least that long. A public key shorter than 65...

ECHO-D4F1-FF9F-2C77

Bulletin has no description...

ECHO-9E4E-C871-FCF8

Bulletin has no description...

CVE-2026-6731

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted...