Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack in the ML-KEM Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines. An attacker can recover a long-term private key by sending ciphertexts and measuring the time taken by repeated decapsulation operations th...

Timing Attack

Overview org.bouncycastle:bcprov-ext-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Timing Attack in the ML-KEM Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines. An attacker can recover a long-term private key...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack in the ML-KEM Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines. An attacker can recover a long-term private key by sending ciphertexts and measuring the time taken by repeated decapsulation operations th...

Timing Attack

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Timing Attack in the ML-KEM Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines. An attacker can recover a long-term private key by...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack in the ML-KEM Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines. An attacker can recover a long-term private key by sending ciphertexts and measuring the time taken by repeated decapsulation operations th...

SUSE-SU-2026:3332-1 Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: Update to upstream tag jdk-21.0.12+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...

Security update for java-25-openjdk

This update for java-25-openjdk fixes the following issues: Update to upstream tag jdk-25.0.4+7 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with netwo...

BIT-THRIFT-2026-58662 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

BIT-THRIFT-2026-58389 Apache Thrift: Rust binary protocol non-strict path missing string size limit

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

BIT-THRIFT-2026-55971 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

BIT-THRIFT-2026-55969 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

BIT-THRIFT-2026-48586 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

BIT-THRIFT-2026-43871 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

BIT-THRIFT-2026-41608 Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-53668

A flaw was found in React Router. Applications using React Router that allow open redirects are vulnerable to Cross-Site Scripting XSS. A remote attacker could craft a malicious link that, when clicked by a user, redirects them to an unexpected external site or exploits an XSS vulnerability,...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a security bypass vulnerability

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a security bypass vulnerability CVE-2026-10842 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...

CVE-2026-16461 affecting package rpcbind for versions less than 1.2.9-1

CVE-2026-16461 affecting package rpcbind for versions less than 1.2.9-1. An upgraded version of the package is available that resolves this issue...

Linux Distros Unpatched Vulnerability : CVE-2026-55969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0...

Linux Distros Unpatched Vulnerability : CVE-2026-45112

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0...

Linux Distros Unpatched Vulnerability : CVE-2026-48586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apac...