PT-2026-67235

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA bcpkix-fips versions prior to 1.0.12 Bouncy Castle for Java FIPS BC-FJA bcpkix-fips versions prior to 2.0.12...

PT-2026-67017

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Description An issue exists in the IESEngine where a MAC forgery is possible in stream-mode due to a length-dependent KDF split. KDF refers to a...

PT-2026-67244

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Description The BKS keystore accepts a legacy version that utilizes a 16-bit integrity MAC key. A Message Authentication Code MAC is a short pie...

Linux Distros Unpatched Vulnerability : CVE-2026-59641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java L...

PT-2026-67226

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA versions prior to 1.0.2.7 Bouncy Castle for Java FIPS BC-FJA versions prior to 2.0.2 Bouncy Castle for Java...

PT-2026-67227

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA versions prior to 2.0.2 Bouncy Castle for Java FIPS BC-FJA versions prior to 2.1.3 Description The HSS...

PT-2026-67343

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA versions prior to 1.0.2.7 Bouncy Castle for Java FIPS BC-FJA versions prior to 2.0.2 Bouncy Castle for Java...

EUVD-2026-51953

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account...

CVE-2026-15236

The Gallery for Google Photos WordPress plugin versions prior to 1.2.1 is vulnerable to an unauthenticated OAuth token disclosure vulnerability. The plugin fails to properly restrict access to stored third-party OAuth credentials, allowing unauthenticated users to access persistent access and ref...

CVE-2026-15236 Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account...

DEBIAN-CVE-2026-65981

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker...

EUVD-2026-51651

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker...

Erlang/OTP 25.0 < 27.3.4.15 / 28.0 < 28.5.0.4 / 29.0 < 29.0.4 Heap Corruption (CVE-2026-55737)

The version of Erlang/OTP installed on the remote host is 25.0 prior to 27.3.4.15, 28.0 prior to 28.5.0.4, or 29.0 prior to 29.0.4. It is, therefore, affected by a vulnerability: - Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who...

SUSE CVE-2026-54890

Integer Underflow Wrap or Wraparound vulnerability in erlang otp erlang/otp erts modules, erlang otp erts erts modules allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BITBINARYEX...

SUSE CVE-2026-55737

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format ETF binary to binarytoterm/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGETUPLEEXT term, the...

CVE-2026-16970 DFIR-IRIS Insufficient Logout Implementation

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time...

CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

CVE-2026-55737

A flaw was found in Erlang OTP. A remote attacker can exploit a vulnerability in the Erlang external term format ETF decoder by providing a specially crafted binary to the binarytoterm/1 function. This manipulation of data types during processing can corrupt the system's memory, leading to an...

SUSE CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...