RLSA-2026:28582 Moderate: keylime security update

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fixes: keylime: Keylime: Security bypass due to hardcoded TPM quote nonce CVE-2026-6420 For more details about the security issues, including the impact, a CVSS score,...

keylime security update

An update is available for keylime. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Keylime is a TPM based highly scalable remote boot attestation and runtime...

CVE-2026-53099

A flaw was found in the Linux kernel. The issue arises from an incorrect configuration option for Control-Flow Integrity CFI, a security mechanism designed to prevent certain types of attacks. Due to a naming change, the CFI code was not properly compiled, leading to its intended protections not...

Exploit for CVE-2026-7574

🚨 CVE-2026-7574 — Claude Desktop Cowork VM Integrity Bypass...

CVE-2026-8720: Improper Validation of Integrity Check Value

wcBlake2bHmacFinal and wcBlake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the...

CVE-2026-48995: Missing Support for Integrity Check

pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if thi...

Multiple vulnerability found in Expat

Expat 2.8.2 was released yesterday. The key motivation for cutting a release and doing so now was getting security and non-security bugsfixes out to users. On the security side, 13 vulnerabilities have been fixed: CVE-2026-50219: missing control flow integrity checks CVE-2026-56131: missing contr...

CVE-2026-50573: Insufficient Verification of Data Authenticity

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm install in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the...

PT-2026-52518

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0 Description In non-frozen mode, pnpm install may accept new remote package content even after detecting that the downloaded tarball does not match the integrity recorded in...

PT-2026-52517

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0 Description The tarball extraction worker in the pnpm package manager fails to perform integrity verification when the integrity field is missing from the lockfile resolution. This...

PT-2026-55842

Summary The vulnerability allows the Request.RemoteAddr to be spoofed when determining the request source IP via the X-Forwarded-For header. This could result in misidentification of the request source and potentially compromise access control and logging integrity. Details Currently, the RealIP...

CVE-2026-9705: Insufficient Session Expiration

A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token RAT, could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker...

CVE-2026-50021: Improper Validation of Integrity Check Value

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL...

CVE-2026-6329: Improper Verification of Cryptographic Signature

PKCS12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted. The PKCS12 verify path compared the locally computed HMAC against the MAC parsed from the PKCS12 structure using a length taken directly fr...

PT-2026-52602

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description PKCS12 MAC verification uses a comparison length controlled by an attacker, which weakens the integrity check on the Message Authentication Code MAC and allows a...

Oracle Unified Directory OUD Core Data Compromise

The vulnerability of the OUD Core component of the Oracle Unified Directory application, which is used for simplified deployment of the Oracle Fusion Middleware software, is related to access control errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Security Framework Component Data Compromise

The vulnerability of the Security Framework component of the Oracle WebCenter Portal is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

ADF Shared Components Data Compromise

The vulnerability of the ADF Shared Components component in the Oracle Application Development Framework is related to access control errors. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

DEBIAN-CVE-2026-39894

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtoolfunctionupdate can corrupt RRDtool metric values. The rrdtoolfunctionupdate function checks metric values with isnumeric and concatenates them into t...

CVE-2026-39894

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtoolfunctionupdate can corrupt RRDtool metric values. The rrdtoolfunctionupdate function checks metric values with isnumeric and concatenates them into t...