Important: Red Hat Security Advisory: compat-openssl11 security update

An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

Important: Red Hat Security Advisory: compat-openssl11 security update

An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

RHEL 9 : compat-openssl11 (RHSA-2026:89737)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89737 advisory. The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the librarie...

PT-2026-125114

Name of the Vulnerable Software and Affected Versions jose versions 1.10.0 through 1.11.12 Description The library uses a password hash with insufficient computational effort when exporting password-encrypted private keys. Specifically, the jose jwk:to der/2 JOSE.JWK.to der/2 function utilizes th...

UBUNTU-CVE-2026-106017

Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions...

PT-2026-125121

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...

RHEL 9 : compat-openssl11 (RHSA-2026:89736)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89736 advisory. The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the librarie...

PT-2026-123444

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been mad...

UBUNTU-CVE-2026-114655

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

PT-2026-123277

A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc get device info key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a loca...

PT-2026-125115

Name of the Vulnerable Software and Affected Versions jose versions 1.10.0 through 1.11.12 Description A timing side channel in the pure-Erlang Curve25519 fallback allows the recovery of a long-term X25519 private key. The implementation uses a recursive Montgomery ladder in the jose jwa...

PT-2026-123421

The Espressif AES driver drivers/crypto/crypto esp32 aes.c advertises a multi-session cipher API — it hands out up to CONFIG ESP32 CRYPTO AES SESSIONS MAX default 4 independent sessions, each carrying its own key and direction. The AES peripheral, however, has a single chip-global set of key and...

RHEL 9 : compat-openssl11 (RHSA-2026:89738)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89738 advisory. The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the librarie...

PT-2026-123416

Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20...

PT-2026-125024

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...

PT-2026-125556

Name of the Vulnerable Software and Affected Versions mpc-lib affected versions not specified Description A cryptographic implementation flaw in the mpc-lib library used in the MPC-based custody pipeline breaks the security guarantee of BIP32 hardened derivation. The issue occurs because the...

PT-2026-123287

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve prompt API to leverage the site owner...

PT-2026-123347

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recov...

PT-2026-123297

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which cou...

PT-2026-123393

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl tlsext ticket key cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read...