CVE-2026-14440

Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the customer's zone. This auto-managed RRset is permissive by design e.g. 'issue "letsencrypt.org"' without parameters. On Universal SSL zones,...

PT-2026-54701

Name of the Vulnerable Software and Affected Versions Cloudflare affected versions not specified Description Cloudflare's Universal SSL feature automatically manages the Certification Authority Authorization CAA Resource Record Set RRset for customer zones. This auto-managed RRset is permissive a...

Factoring RSA Keys with Many Zeros

Interesting research on a new class of weak RSA keys: keys with lots of zeros. It turns out that these keys are out in the wild. The badkeys project is an open-source service that checks public keys for known vulnerabilities. While developing this tool, Hanno collected a massive number of...

CLEANSTART-2026-GZ11549 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

Multiple security vulnerabilities affect the certificate-transparency-trillian-ctserver package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. See references for individual vulnerability details...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: mc, splunk-otel-collector, amazon-cloudwatch-agent-operator, metrics-server, karma, opentelemetry-collector, trillian, minio, k8sgpt, opentelemetry-operator, loki, prometheus-pushgateway, fluent-bit-plugin-loki, mcp-grafana, certificate-transparency, tempo,...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: cloudzero-agent, opentelemetry-collector-fips, datadog-agent-fips, loki-fips, node-problem-detector, google-cloud-otel-ops-collector, prometheus-fips, agentbeat-fips, jaeger, opentelemetry-collector-contrib, keda-fips, amazon-cloudwatch-agent-operator-fips,...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: ldap2pg, temporal, gitlab-elasticsearch-indexer-fips, sqlexporter, spqr, keda-fips, rke2-runtime, dapr-fips, bento-fips, sftpgo-plugin-eventstore, gitaly, certificate-transparency-fips, hydra, ory-kratos, seaweedfs-rocksdb, seaweedfs-fips, kine, step-issuer-fips,...

Google's Android Apps Get Public Verification to Stop Supply Chain Attacks

Google has announced expanded Binary Transparency for Android as a way to safeguard the ecosystem from supply chain attacks. "This new public ledger ensures the Google apps on your device are exactly what we intended to build and distribute," Google's product and security teams said. The initiati...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: ytt, aws-flb-cloudwatch, pdfcpu, metrics-agent, hubble-ui, hugo-extended, kubernetes-csi-external-attacher, step, aws-flb-kinesis, docker-credential-gcr, docker-credential-ecr-login, ingress-nginx-controller, certificate-transparency, crossplane-provider-family-azure...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: argo-events, aws-flb-cloudwatch, grafana-agent-operator, swagger, envconsul, vexctl, amazon-cloudwatch-agent-operator, sftpgo-plugin-pubsub, cilium-cli, emissary, hubble-ui, nerdctl, smarter-device-manager, mattermost, volume-modifier-for-k8s, kubernetes-dashboard,...

gnutls: Vulnerability in GnuTLS SCT extension parsing

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency CT Signed Certificate Timestamp SCT extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension OID...

CLEANSTART-2026-YR14817 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68119, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 1.3.2-r0

Multiple security vulnerabilities affect the certificate-transparency-trillian-ctserver package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-24122

Cosign

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: amass, gitsign, kubeflow-pipelines, splunk-otel-collector, grafana-alloy, terragrunt, temporal, tailscale, juicefs, hydra, kyverno-policy-reporter, nri-mysql, dex, crossplane-provider-sql, openbao, mattermost, cerbos, trillian, minio, loki, step, kots, tkn, ksops,...

Siemens SIMATIC S7-1500 Improper Certificate Validation (CVE-2025-32989)

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency CT Signed Certificate Timestamp SCT extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension OID...

Astra Linux – Vulnerability in gnutls28

A heap-buffer-overread vulnerability was discovered in GnuTLS regarding its handling of the Certificate Transparency CT Signed Certificate Timestamp SCT extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension OID...

Security Bulletin: Allocation of resources without limits, heap-buffer-overread, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency service is vulnerable to allocation of resources without limits, heap-buffer-overread, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-32988 DESCRIPTION: A flaw was found in GnuTLS. A double-free vulnerability...

EUVD-2017-2993

Malware in sbrugna...

gnutls: Vulnerability in GnuTLS SCT extension parsing

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency CT Signed Certificate Timestamp SCT extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension OID...

gnutls: Vulnerability in GnuTLS SCT extension parsing

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency CT Signed Certificate Timestamp SCT extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension OID...