CLEANSTART-2026-YQ62547 Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms

CVE-2026-54875 affects multiple packages. Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. See references for individual vulnerability details...

CLEANSTART-2026-SE65887 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

EUVD-2026-107666

A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials. Successful exploitation...

EUVD-2026-107577

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against knownhosts. connect reports success as soon as sshconnect returns SSHOK. libssh leaves the known-hosts check to the application, and this binding never makes it, so th...

EUVD-2026-107576

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

PT-2026-121537

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1 Description Failure to write response audit entries occurs for the unauthenticated 'sys/generate-root', 'sys/rekey', and 'sys/rekey-recovery-key' endpoints when request audi...

PT-2026-121543

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.2.0 through 2.6.3 OpenBao versions 2.7.0 Description An information disclosure issue exists where the tls acme eab mac key value is exposed through the 'sys/config/state/sanitized' endpoint. This allows callers of the...

MongoDB libmongocrypt input validation error vulnerability

A vulnerability related to input validation exists in MongoDB libmongocrypt versions from 1.0.0 up to but including version 1.21.1. This vulnerability arises because when constructing requests to external key management services AWS, Azure, and GCP, values derived from key vault documents, KMS...

OpenBao log information leakage vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a log information leakage vulnerability. This occurs when request audit logs are successfully recorded but response audit logs fail to be recorded; as a result, no response audit entries are written for unauthenticated...

Bridging Number-Theoretic Primality Testing and Algorithmic Optimization: An Adaptive Cryptographic Framework

The security of modern public-key cryptographic systems, such as RSA, Diffie-Hellman, and ECC, depends entirely on the computational intractability of the integer factorization and discrete logarithm problems. For these asymmetric algorithms to operate, a core requirement is that the system must ...

PT-2026-121317

Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions...

PT-2026-121526

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

PT-2026-121259

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information...

PT-2026-121407

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...

Linux Distros Unpatched Vulnerability : CVE-2026-94140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote...

PT-2026-121316

Name of the Vulnerable Software and Affected Versions WatchGuard Endpoint Security affected versions not specified Description WatchGuard Endpoint Security's Full Disk Encryption feature for macOS stores sensitive information in cleartext. A local, unprivileged user or process can obtain the...

PT-2026-121662

Name of the Vulnerable Software and Affected Versions Authlib versions 1.3.1 through 1.8.9 Description An issue exists in the OctKey.import key function within authlib/jose/rfc7518/oct key.py where asymmetric-key markers are only checked at byte zero. Because PEM loaders accept leading whitespace...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142519)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142519 advisory. In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy...

CVE-2026-105711 Use of Cache Containing Sensitive Information in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could...

CVE-2026-105711

GitLab CE/EE versions 15.0 to 19.3.6, 19.4 to 19.4.3, and 19.5 to 19.5.1 are vulnerable to a use of cache containing sensitive information (CWE-524). The root cause is a viewer-independent fragment cache key that incorrectly shares per-user-redacted rendered content across all users. This allows ...