CVE-2026-47688 FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node...

Security Bulletin: This Power System update is being released to address CVE-2026-4932

Summary A firmware issue was identified where the generated AES key used to initialize the Transparent Memory Encryption TME hardware has weakened encryption strength. Vulnerability Details CVEID:CVE-2026-4932 DESCRIPTION: PowerVM Hypervisor could allow an attacker with physical access to the...

Security update for php7

This update for php7 fixes the following issue CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypp...

SUSE-SU-2026:3165-1 Security update for php7

This update for php7 fixes the following issue - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351...

Security update for php8

This update for php8 fixes the following issues Update to version 8.3.32. CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS bsc1270712. CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351...

SUSE-SU-2026:3164-1 Security update for php8

This update for php8 fixes the following issues - Update to version 8.3.32 - CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS bsc1270712. - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc12703...

AZL-93246 CVE-2026-59847 affecting package libssh for versions less than 0.10.6-9

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

UBUNTU-CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

A flaw was found in OpenSSL. The implementations of AES-SIV Advanced Encryption Standard - SIV and AES-GCM-SIV Advanced Encryption Standard - Galois/Counter Mode - SIV incorrectly process authentication tags for empty messages. This vulnerability allows a remote attacker to forge empty messages...

openssl: AES-OCB IV Ignored on EVP_Cipher() Path

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface EVPCipher will have their provided Initialization Vector IV silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the...

openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()

A flaw in OpenSSL causes EVPCipher to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid...

EUVD-2026-46255

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-59847 Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-59847

CVE-2026-59847 affects the OpenSSH/libssh stack via an integrity downgrade caused by incorrect AES-GCM tag verification when using the OpenSSL backend. The provided connected documents indicate the issue in libssh before 0.11.5, with the vulnerability enabling an in-path attacker to compromise in...

CVE-2026-59847 Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection. Mitigation Disable the [email protected] and [email protected]...

Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length bsc1270542. CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrapkey bsc1270705. CVE-2026-41681:...