10 matches found
EUVD-2026-52135
In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...
CVE-2026-12816
In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...
CVE-2026-12816
Bouncy Castle for Java contains an IESEngine stream-mode MAC forgery flaw via a length-dependent KDF split, affecting versions before 1.85 (and Bouncy Castle for Java LTS before 2.73.12). The issue is documented in CVE-2026-12816 with no exploitation details provided in the supplied sources. No r...
MGASA-2026-0071 Updated nodejs packages fix security vulnerabilities
Incomplete fix for CVE-2026-21637: loadSNI in tlswrap.js lacks try/catch leading to Remote DoS. CVE-2026-21637 Denial of Service via proto header name in req.headersDistinct Uncaught TypeError crashes Node.js process. CVE-2026-21710 Timing side-channel in HMAC verification via memcmp in...
Observable Timing Discrepancy
Overview Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the cryptohmac.cc module using memcmp, a non-constant-time comparison function to validate user-provided HMAC signatures, rather than the timing-safe equivalents used elsewhere in the codebase. An...
Node.js: Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery
Vulnerability description not provided...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002454)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002454 advisory. The evmverifyhmac function in security/integrity/evm/evmmain.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003094)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003094 advisory. The evmverifyhmac function in security/integrity/evm/evmmain.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to...
PT-2026-28319
Name of the Vulnerable Software and Affected Versions Node.js versions 20.x through 25.x Description A flaw exists in the Node.js Permission Model's filesystem enforcement, specifically leaving the fs.realpathSync.native function without the necessary read permission checks. Comparable filesystem...