CLSA-2026-1792810818 libX11: Fix of CVE-2026-88806

CVE-2026-88806: check key action ranges in XkbReadKeyActions...

CLSA-2026-1792810382 libX11: Fix of CVE-2026-88806

CVE-2026-88806: check key action ranges in XkbReadKeyActions...

How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943 and CVE-2026-111944)

Executive Summary A critical certificate authority incident disclosed on October 17, 2026, impacts eight eMudhra intermediate CA certificates. A flaw in the key generation process could allow attackers to recover private keys and issue fraudulent TLS or code-signing certificates. The affected...

Amazon Linux 2 : edk2 (ALAS-2026-4007)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4007 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap growth when OpenSSL cachesX.509 extensions. Impact summary: Receiving a crafted...

Important: edk2

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

Securing Edge and Physical AI: Post-Quantum IoT Blockchain for Mission-Critical Cyber-Physical Agents

Distributed Cyber-Physical Systems CPS and Edge AI networks increasingly depend on public-key authentication and key-establishment mechanisms that are vulnerable to cryptographically relevant Quantum Computers QC. Shor's algorithm threatens widely deployed asymmetric primitives, while Grover's...

Node.js 26.5.0 HTTPS Agent PFX Client Identity Collision

Node.js versions 22.x, 24.x, and 26.x contain an HTTPS Agent PFX object-array key collision that can reuse mTLS client identities across requests configured with different client certificates...

SUSE CVE-2026-105963

Externally-Generated Error Message Containing Sensitive Information vulnerability in plugcrypto in elixir-plug plugcrypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in Plug.Crypto validates...

CVE-2026-98845

A flaw was found in the Linux kernel's Trusted Platform Module TPM subsystem. This vulnerability allows an attacker to bypass TPM reset protections because the driver fails to disable the device when a null key integrity check fails. Consequently, the TPM continues serving requests and...

CVE-2026-75525

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. Th...

CVE-2026-75525 OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. Th...

CVE-2026-75525 OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. Th...

EUVD-2026-109159

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. Th...

CVE-2026-75525

In OpenReception appointment booking software versions 2.1.0 and prior , an unauthenticated remote attacker can perform an ML-KEM key injection into the staff-crypto recipient directory of any tenant. By storing an arbitrary ML-KEM-768 public key under an existing user's identity, the attacker be...

CVE-2026-112342

Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permissionhelper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cache...

EUVD-2026-109121

Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permissionhelper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cache...

CVE-2026-112342 Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning

Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permissionhelper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cache...

CVE-2026-114612

A flaw was found in LiteLLM. The proxy server reuses the same cryptographic key for encrypting stored data and generating session authentication tokens. An authenticated attacker can exploit this flaw by submitting crafted metadata to obtain an encrypted administrator credential, which can then b...

SUSE CVE-2026-106017

Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions...

Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities

Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedent...