joserfc: joserfc: JWT Malleability via Non-Standard Padding

A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption JOSE standards. This vulnerability allows the library to accept JSON Web Tokens JWTs that include non-standard trailing padding. An attacker could exploit this to create malleable JWTs, potentially bypassing...

CVE-2026-62995

A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption JOSE standards. This vulnerability allows the library to accept JSON Web Tokens JWTs that include non-standard trailing padding. An attacker could exploit this to create malleable JWTs, potentially bypassing...

CVE-2026-64385

The CVE-2026-64385 entry relates to a Linux kernel SMB client double-free in SMB2_ioctl() replay. The underlying issue is a stale buffer being freed twice when an SMB2_ioctl_init() path fails before the next send; the fix resets response bookkeeping before each attempt to prevent the stale free. ...

PT-2026-64606

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt may return a replayable error and free its response buffer. If the SMB2 ioctl init function fails before the...

PT-2026-64607

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt can return a replayable error and free its response buffer. If the SMB2 query info init function fails before the...

PT-2026-64603

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt can return a replayable error and free its response buffer. If the SMB2 open init function fails before the...

CVE-2026-63925

A flaw was found in the Linux kernel's MACsec Media Access Control Security subsystem. When using Extended Packet Numbering XPN, a vulnerability exists where the replay protection mechanism can be bypassed. An attacker can exploit an integer overflow when the packet number reaches its maximum...

SUSE CVE-2026-63925

In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsecpostdecrypt, when pn is U32MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If nextpnhalves.lower is also in the upper half, pnsamehalfpn, lower is true...

SUSE CVE-2026-63976

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan-ident on ECRED reconfiguration success l2capecredreconfrsp returns early on success without clearing chan-ident. Every other L2CAP response handler l2capecredconnrsp, l2capleconnectrsp, l2capconfigrsp...

CVE-2026-63976

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan-ident on ECRED reconfiguration success l2capecredreconfrsp returns early on success without clearing chan-ident. Every other L2CAP response handler l2capecredconnrsp, l2capleconnectrsp, l2capconfigrsp...

CVE-2026-63976

Summary (CVE-2026-63976) : In the Linux kernel’s Bluetooth L2CAP path, ECRED reconfiguration success could fail to clear chan->ident, allowing a remote peer to replay a failure with the stale ident and cause the kernel to match/destroy an already-established channel (via l2cap_chan_del with EC...

EUVD-2026-45698

In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsecpostdecrypt, when pn is U32MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If nextpnhalves.lower is also in the upper half, pnsamehalfpn, lower is true...

CVE-2026-63925 macsec: fix replay protection at XPN lower-PN wrap

In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsecpostdecrypt, when pn is U32MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If nextpnhalves.lower is also in the upper half, pnsamehalfpn, lower is true...

CVE-2026-63925

In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsecpostdecrypt, when pn is U32MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If nextpnhalves.lower is also in the upper half, pnsamehalfpn, lower is true...

CVE-2026-63925

The CVE-2026-63925 issue affects the Linux kernel macsec XPN replay protection logic. When pn equals U32_MAX, pn+1 overflows to 0 and the code path for updating next_pn_halves may not fire, allowing an attacker to replay a frame carrying pn == 0xFFFFFFFF on an XPN association. The fix extends the...

PT-2026-61242

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the macsec post decrypt function where a replay protection failure occurs during an Extended Packet Number XPN lower-PN wrap. When the packet number pn reaches U32 MAX...

PT-2026-61293

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth L2CAP implementation where the l2cap ecred reconf rsp function fails to clear the chan-ident variable upon a successful ECRED reconfiguration. This diffe...

CVE-2026-54779 CoreWCF: SAML token replay protection is inoperative

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled, allowing a captur...

CVE-2026-54779

CoreWCF (Windows Communication Foundation port for .NET Core) has a SAML token replay protection flaw prior to versions 1.8.1 and 1.9.1. The issue arises because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled, allowing a captured token to be r...

CVE-2026-54779 CoreWCF: SAML token replay protection is inoperative

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled, allowing a captur...