PT-2026-102981

Name of the Vulnerable Software and Affected Versions oauthlib affected versions not specified Description A timing side-channel exists in the PKCE implementation of the Authorization Code Grant flow. The functions code challenge method plain and code challenge method s256 in the file...

UBUNTU-CVE-2026-54872

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

GAZEleak: Passcode Inference against Eye-Tracking XR Devices through External Observation

Mixed-reality headsets such as Apple Vision Pro replace the touch screen with gaze-as-pointer interaction: the wearer looks at a target and confirms with an air pinch. Because the display is inside the headset and the eye tracker is walled off from third-party software, such input is widely assum...

OT-PCA: New Key-Recovery Plaintext-Checking Oracle Based Side-Channel Attacks on HQC with Offline Templates

In this paper, we introduce OT-PCA, a novel approach for conducting Plaintext-Checking PC oracle based side-channel attacks, specifically designed for Hamming Quasi-Cyclic HQC. By calling the publicly accessible HQC decoder, we build offline templates that enable efficient extraction of soft...

Application Agnostic EM Side-Channel Emanations of the FPGA Clock Distribution Network

Electromagnetic side channels have been extensively utilized in non-invasive attacks or analyses to extract critical information from deployed systems. Most of the attacks or analyses are typically executed on cryptographic algorithms under the assumption that the underlying implementation remain...

S-ALSA: Co-Design of Adiabatic Logic-Based Sensing and Balanced Bit-Cells for Secure and Energy-Efficient MRAM

Magnetoresistive Random Access Memory MRAM technologies such as Spin-Transfer Torque STT-MRAM and Spin-Orbit Torque assisted SOT-STT-MRAM offer nonvolatility and low leakage, making them attractive for IoT systems. However, conventional MRAM read circuits face two fundamental challenges: high...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Leakage of side-channel information in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in NoStatePrefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

[SECURITY] [DLA 4791-1] memcached security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4791-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA September 23, 2026 https://wiki.debian.org/LTS -...

Do Electromagnetic Side-Channel Attacks Threaten Electronic Polling Stations? Scenarios and Recommendations

This paper investigates the threat to ballot secrecy in the Brazilian electronic voting machine UEB posed by electromagnetic side-channel attacks, also known as TEMPEST attacks. In these attacks, screen content can be reconstructed remotely by intercepting electromagnetic emanations associated wi...

Debian dla-4791 : memcached - security update

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4791 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4791-1 [email protected]...

Fast Frame Rate Estimation in Electromagnetic Side-Channel Attacks on Public Systems

Frame refresh rate estimation is a fundamental step in identifying compromising harmonic frequencies in electromagnetic side-channel attacks. Methods based on discrete linear autocorrelation DLA are robust across different scenarios and require a computational complexity of $ON\log N$ for a signa...

EUVD-2026-84532

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Summary validateUser in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword: async validateUserloginOrEmail: string, password: string, ip?: string, scope?:...