ANT-2026-87DJGDRB · wolfssl · Heap-buffer-overflow

heap-buffer-overflow low CVE-2026-12340 GHSA-q349-x427-xg3w Severity Claude high · Security research firm high · Maintainer low Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-87DJGDRB: Heap-buffer-overflow in sha.c:733 When...

python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

A flaw was found in cryptography, a Python package for cryptographic primitives. This vulnerability, known as a Bleichenbacher oracle, arises during PKCS7 EnvelopedData decryption. An attacker can exploit distinguishable error messages and timing differences during decryption to gain information...

Exploit for CVE-2026-6837

CVE-2026-6837: Zyxel export-cgi PKCS12 Command Injection T...

Security Bulletin: This Power System update is being released to address CVE-2026-22796

Summary PowerVM relies on OpenSSL to support a range of features, such as virtual TPM, LPM, and other functionalities that require cryptographic operations. This bulletin provides a remediation for the impacted vulnerability, CVE-2026-22796 by upgrading PowerVM and thus addressing the exposure to...

CVE-2026-16458

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

CVE-2026-16459

Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

CVE-2026-16458

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

CVE-2026-16458

The CVE concerns Oberon microsystem AG’s ocrypto library, affected in all versions since 3.0.0 and before 4.0.1. The issue is a padding oracle/timing side-channel flaw in RSA PKCS#1 v1.5 decryption that enables an attacker with local access to recover plaintexts by measuring decryption timing. Th...

CVE-2026-16458 Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

EUVD-2026-57758

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

EUVD-2026-57756

Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

CVE-2026-16459 Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto

Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

CVE-2026-16459

Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

CVE-2026-16459

CVE-2026-16459 : Padding oracle timing side-channel vulnerability in Oberon Microsystems’ Oberon PSA Crypto library. All versions from 1.0.0 up to, but not including, 2.1.1 are affected. An attacker can recover plaintexts by measuring execution time during RSA PKCS#1 v1.5 decryption. The public d...

PT-2026-71405

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

CVE-2026-47232

Admidio prior to v5.0.10 exposes a sensitive action (mode=export) that returns a PKCS#12 bundle containing the private key and certificate without requiring CSRF validation. The vulnerability arises because the CSRF check in modules/sso/keys.php is commented out, enabling a forged POST from an au...

CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

CVE-2026-73281

A flaw was found in OpenSSH's ssh-agent component. A misinteraction between agent locking and the [email protected] extension allows operations intended for local execution to be performed remotely. This could enable a remote attacker to add PKCS11 tokens or utilize keys with destination...

EUVD-2026-54850

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...