CVE-2026-26958 filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If Point.MultiScalarMult i...

CVE-2026-26958

CVE-2026-26958 affects filippo.io/edwards25519. In v1.1.0 and earlier, MultiScalarMult can produce invalid results or undefined behavior if the receiver is not the identity point; an initialized non-identity receiver yields an incorrect result, and a zero/uninitialized receiver yields invalid beh...

CVE-2026-26958

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If Point.MultiScalarMult i...

filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity

Point.MultiScalarMult failed to initialize its receiver. If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result. If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver wa...

Improper Initialization

Overview Affected versions of this package are vulnerable to Improper Initialization via the MultiScalarMult function when the receiver is not properly initialized. An attacker can cause invalid results or undefined behavior by invoking this function on an uninitialized or non-identity receiver...

GHSA-FW7P-63QQ-7HPR filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity

Point.MultiScalarMult failed to initialize its receiver. If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result. If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver wa...

Citrix Receiver App for Windows Remote Code Execution Vulnerability (CTX251986)

The version of Citrix Receiver installed on the remote host is affected by a remote code execution vulnerability due to incorrect access control. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands on the remote host. %NASLMINLEVEL 80900 C...

filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity

Point.MultiScalarMult failed to initialize its receiver. If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result. If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver wa...

PT-2026-20785

Name of the Vulnerable Software and Affected Versions filippo.io/edwards25519 versions 1.1.0 and earlier Description The filippo.io/edwards25519 Go library, used for edwards25519 elliptic curve cryptography, has an issue where the MultiScalarMult function produces incorrect results or undefined...

Landray EIS SQL注入漏洞

Landray EIS 2001 through 2006 contains a SQL injection caused by unsanitized input in Message/fimessagereceiver.aspx?replyid=, letting attackers execute arbitrary SQL commands, exploit requires crafted input. id: CVE-2025-22214 info: name: Landray EIS SQL注入漏洞 author: Ark severity: critical...

AirCatch: Effectively Tracing Advanced Tag-Based Trackers

Tag-based tracking ecosystems help users locate lost items, but can be leveraged for unwanted tracking and stalking. Existing protocol-driven defenses and prior academic solutions largely assume stable identifiers or predictable beaconing. However, identifier-based defenses fundamentally break do...

oneshot has potential Use After Free when used asynchronously

There is a race condition that can lead to a use-after-free if a oneshot::Receiver is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar. When the Receiver is...

GHSA-RVR2-R3PV-5M4P oneshot has potential Use After Free when used asynchronously

There is a race condition that can lead to a use-after-free if a oneshot::Receiver is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar. When the Receiver is...

PT-2026-4680

A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09 55. Impacted is an unknown function of the component UART Interface. The manipulation results in missing authentication. An attack on the physical device is feasible. This attack is characterized by high complexity. The...

RUSTSEC-2026-0005 Potential use-after-free in `oneshot` when used asynchronously

There is a race condition that can lead to a use-after-free if a oneshot::Receiver is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar. When the Receiver is...

Potential use-after-free in `oneshot` when used asynchronously

There is a race condition that can lead to a use-after-free if a oneshot::Receiver is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar. When the Receiver is...

kernel security update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003950)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003950 advisory. An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hciuartregisterdev fails in hciuartsetproto in...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002765)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002765 advisory. The hidinputfield function in drivers/hid/hid-core.c in the Linux kernel before 4.6 allows physically proximate attackers to obtain sensitive information from kernel...

Astra Linux – Vulnerability in rsync

A malicious client acting as the recipient of an rsync file transfer can trigger an out-of-bounds read of a heap-based buffer, through a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger this issue...