CVE-2026-23966

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can...

EUVD-2026-3676

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can...

CVE-2026-23966

CVE-2026-23966 (sm-crypto) affects the JavaScript library implementing SM2/SM3/SM4. The vulnerability resides in the SM2 decryption logic, where an attacker can recover the private key by repeatedly invoking the SM2 decryption interface. The issue exists in versions prior to 0.3.14; version 0.3.1...

CVE-2026-23966 sm-crypto Affected by Private Key Recovery in SM2-PKE

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can...

Azure Linux 3.0 Security Update: hyperv-daemons (CVE-2024-26974)

The version of hyperv-daemons installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-26974 advisory. - In the Linux kernel, the following vulnerability has been resolved: crypto: qat - resolve race...

Azure Linux 3.0 Security Update: kernel (CVE-2025-39989)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-39989 advisory. - In the Linux kernel, the following vulnerability has been resolved: x86/mce: use iscopyfromuser to determine...

Azure Linux 3.0 Security Update: kernel (CVE-2024-46735)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46735 advisory. - In the Linux kernel, the following vulnerability has been resolved: ublkdrv: fix NULL pointer dereference in...

PT-2026-3933

Name of the Vulnerable Software and Affected Versions Sangfor Operation and Maintenance Security Management System versions prior to 3.0.13 Description A security flaw exists in Sangfor Operation and Maintenance Security Management System. The issue involves the edit pwd mall function within the...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38283)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38283 advisory. - In the Linux kernel, the following vulnerability has been resolved: hisiaccvfiopci: bugfix live migration...

CVE-2026-21977

Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance component: Security. Supported versions that are affected are 23.1.0-23.1.202509. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

sm-crypto Affected by Private Key Recovery in SM2-PKE

Summary A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Credit This vulnerability was discovered...

Insufficient Verification of Data Authenticity

Overview org.webjars.npm:sm-crypto is a sm-crypto Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the SM2 decryption logic. An attacker can recover sensitive private key material by repeatedly interacting with the decryption interface...

Insufficient Verification of Data Authenticity

Overview sm-crypto is a sm-crypto Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the SM2 decryption logic. An attacker can recover sensitive private key material by repeatedly interacting with the decryption interface. Remediation Upgrade...

GHSA-PGX9-497M-6C4V sm-crypto Affected by Private Key Recovery in SM2-PKE

Summary A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Credit This vulnerability was discovered...

Cryptographic Weakness

Elliptic is vulnerable to cryptographic weakness. The vulnerability is due to incorrect byte-length computation and truncation of the RFC 6979 deterministic nonce k when it contains leading zeros, which results in faulty signatures and allows an attacker, under certain conditions, to derive the...

EUVD-2026-3535

Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance component: Security. Supported versions that are affected are 23.1.0-23.1.202509. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

PT-2026-3893

Name of the Vulnerable Software and Affected Versions sm-crypto versions prior to 0.3.14 Description sm-crypto, a JavaScript library providing implementations of Chinese cryptographic algorithms SM2, SM3, and SM4, contains a flaw in the SM2 decryption logic. An attacker can recover the private ke...

Restore to AWS EC2 Fails with: "ClientError: Unknown OS / Missing OS files" or "FirstBootFailure"

Challenge When restoring a VM to AWS EC2, one of the following errors occurs: StatusMessage: "CLIENTERROR : ClientError: Unknown OS / Missing OS files." Failed to import machine to Amazon EC2: CLIENTERROR : FirstBootFailure: This import request failed because the instance failed to boot and...

Restore to Google Compute Engine Fails with API Errors When Using Helper Appliance

Challenge When restoring a VM to Google Compute Engine GCE, the following errors occur: For Windows platform: Failed to restore to GCE: import-image: datestamp step "import" run error: step "wait-for-bootstrap" did not complete within the specified timeout of 20m0s System.Exception For Linux...

PT-2026-3861

Name of the Vulnerable Software and Affected Versions NexusFlow API Gateway versions prior to 3.8.1 Description A critical remote code execution issue exists in NexusFlow API Gateway. This issue is actively exploited by unauthenticated attackers, allowing them to gain full control of servers. The...