PT-2026-118435

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the NX CRYPTO MAX RSA MODULUS SIZE default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a...

PT-2026-119556

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.1 through 12.2 Description A remote attacker could obtain sensitive information because the software uses a hard-coded cryptographic key. A hard-coded cryptographic key is a fixed key embedded directly...

WS-2026-0133

certifi 2019.03.09 through 2026.07.22 ships the "emSign ECC Root CA - G3" root certificate in its CA bundle certifi/cacert.pem. Intermediates under this root were revoked for key compromise cACompromise, so certificates issued with the compromised CA keys are trusted by applications that use...

PT-2026-118407

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46163)

In the Linux kernel, the following vulnerability has been resolved: wifi: b43legacy: enforce bounds check on firmware key index in RX path Same fix as b43: the firmware-controlled key index in b43legacyrx can exceed dev-maxnrkeys. The existing B43legacyWARNON is non-enforcing in production builds...

PT-2026-118672

Name of the Vulnerable Software and Affected Versions Custom Tables plugin for WordPress versions prior to 3.4.6 Description A reflected cross-site scripting issue exists that allows unauthenticated attackers to inject scripts into victims' browsers to steal cookies. This occurs via the unsanitiz...

Apache Camel 4.22.0 AS2 MDN Signing Key Confusion

Apache Camel version 4.22.0 AS2 component contains a race condition that can cause Message Disposition Notifications in multi-partner deployments using dynamic keys to be signed with a different partner's private key. https://packetstorm.news/download/236482...

PT-2026-118363

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2026-77369)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-77369 advisory. - CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap Resolves: RHEL-256961 modauthopenidc Tenable has extracted the preceding description...

RHEL 10 : cjose (RHSA-2026:80605)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:80605 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content...

VulnCheck KEV: CVE-2012-20003

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...

Linux Distros Unpatched Vulnerability : CVE-2026-98845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from servin...

CVE-2012-20003: Improper Neutralization of Input During Web Page Generation

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...

AlmaLinux 9 : compat-openssl11 (ALSA-2026:80514)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:80514 advisory. openssl: heap buffer overflow in CMS key unwrapping CVE-2026-63072 openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offse...

openssl security update

1:1.1.1k-18 - Fix CVE-2026-63072: heap buffer overflow in CMS key unwrapping Resolves: RHEL-246295 - Fix CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset Resolves: RHEL-264420...

ALSA-2026:85968 Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: heap buffer overflow in CMS key unwrapping CVE-2026-63072 openssl: compat-openssl: DTLS Retransmi...

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: heap buffer overflow in CMS key unwrapping CVE-2026-63072 openssl: compat-openssl: DTLS Retransmi...

Atlassian Jira Service Management Data Center and Server < 10.3.26 / 10.4.x < 11.3.12 (JSDSERVER-16839)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16839 advisory. - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1,...

SUSE CVE-2026-98845

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

CVE-2026-111061

A flaw was found in russh. When processing key addition requests containing lifetime constraints, the Secure Shell SSH agent server spawns a separate long-lived task for repeated constraint records and fails to roll back tasks if subsequent parsing fails. An attacker capable of communicating with...