PT-2026-102657

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description SM2 signature generation uses non-constant-time arithmetic on secret values, creating a timing side-channel. The process computes the signature value using...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-3128)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3128 advisory. When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on...

Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

Timing Side-Channel in SM2 Signature Generation

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

PT-2026-102772

Name of the Vulnerable Software and Affected Versions NetX Secure affected versions not specified Description When built with NX SECURE KEY CLEAR, the software wipes every TLS record sent on an active session after it is handed to TCP. Because the TCP layer may have already released the packet...

Important: cjose

Issue Overview: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW does not validate the length of the attacker-supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-77696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to...

PT-2026-109082

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

PT-2026-109021

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

PT-2026-109046

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

PT-2026-109038

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

CVE-2026-77696: Observable Timing Discrepancy

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

RHEL 9 : cjose (RHSA-2026:73128)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:73128 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: cjose: Heap buffer overflow in AES Key Wra...

RHEL 10 : cjose (RHSA-2026:73129)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:73129 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: cjose: Heap buffer overflow in AES Key Wr...

PT-2026-109016

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

CVE-2026-54872: Observable Timing Discrepancy

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

CVE-2026-54872: Observable Timing Discrepancy

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

PT-2026-109047

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

PT-2026-102650

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations leaks information about the secret nonce through timing discrepancies...

Amazon Linux 2023 : environment-modules, environment-modules-compat (ALAS2023-2026-3135)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3135 advisory. modulecomgenwordsandfiles fed untrusted text module names readoff disk, LOADEDMODULES, MODULEPATH straight into compgen -W, whichperforms a full unquoted-word expansion on its wordlist --...