TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

Overview Two vulnerabilities have been identified in the Trusted Platform Module TPM 2.0 reference implementation: 1. CVE-2026-6726 – Information leakage via falsified TPM keys. 2. CVE-2026-6727 – A timing side-channel vulnerability in RSA OAEP decryption. An attacker with privileged access to a...

Trusted Platform Module (TPM) Reference Code Errata

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Score ---|---|--- CVE-2026-6726 non-AMD| An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a...

CVE-2026-6727: Observable Timing Discrepancy

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

PT-2026-70244

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may...

CVE-2026-48048

XWiki Platform is vulnerable due to an insufficient patch for GHSA-5cf8-vrr8-8hjm in the LiveTableResults endpoint. Affected versions are 6.2.1 and earlier than 18.0.0RC1, 17.10.13, 17.4.9, and 16.10.17. By sending slightly modified parameters to LiveTableResults, an attacker can reconstruct a us...

Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference

The key-value KV cache is the primary throughput optimization in modern large language model LLM inference, enabling prefix reuse across requests. In multi-tenant deployments this cache is shared across tenants, creating a timing side channel: an adversarial tenant can reconstruct another tenant'...

Extracting VM Secrets through Power Side Channels on AMD SEV-ES and SEV-SNP

Revisions Revision Date| Description ---|--- 2026-08-10| Initial publication...

Linux Distros Unpatched Vulnerability : CVE-2026-68269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/gem: Add missing nospec on parallel submit slot Add missing Spectre mitigation for userspace controlled parallel submission slot. Discovered using...

CVE-2024-14041

A flaw was found in Bouncy Castle for Java, affecting ML-KEM CRYSTALS-Kyber routines. Specifically, the Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines, which handle secret-derived polynomial coefficients, perform division by the modulus q. A remote attacker can exploit this...

SLAC: Access-Driven CPU-To-GPU Side-Channel Attacks Via System-Level Cache on Apple Silicon

Modern heterogeneous System-on-Chip designs integrate CPU cores and a GPU that share a last-level cache LLC or system-level cache SLC. This sharing exposes a new cross-domain attack surface, and existing attacks on integrated platforms either exploit coarse-grained cache-occupancy contention or...

CVE-2026-44965

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

CVE-2026-44965

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

CVE-2026-44965

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

EUVD-2026-54571

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

CVE-2026-44965

The Datadog Android application prior to version v545-5.9.2 is vulnerable to an improper export of Android components. Six specific App Widget configuration activities (IncidentWidgetActivity , MonitorSavedViewWidgetActivity , OnCallShiftsWidgetActivity , OnCallPagesWidgetActivity , SloWidgetActi...

PT-2026-69088

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 545-5.9.2 Description Six App Widget configuration activities—IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and...

AZL-94628 CVE-2025-49506 affecting package apr-util for versions less than 1.6.3-3

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2025-49506

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2026-16731

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

EUVD-2026-53923

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...