PT-2026-97780

Name of the Vulnerable Software and Affected Versions O2OA versions prior to 9.5.4 O2OA versions prior to 10.0.3 Description An issue exists in the Cipher Connection Handler component within the list function of the o2server/x base core...

CVE-2026-95814

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

CVE-2026-95814 Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

CVE-2026-95814 Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

CVE-2026-95814 Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

EUVD-2026-84861

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

CVE-2026-95814

Versions of Vaultwarden through 1.37.3 are vulnerable to an authorization bypass due to a missing status check in organization membership validation. Specifically, the application fails to filter membership status in three queries: get_user_collections_access_flags, get_group_collections_access_f...

CVE-2023-54356

A flaw was found in Kyverno. The software supports insecure 3DES cipher suites on its TLS endpoints. A remote attacker could exploit this vulnerability, known as the Sweet32 attack, to recover small amounts of plaintext data. This exploitation requires very long-lived TLS connections carrying lar...

PT-2026-97055

Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.37.4 Description Organization membership status validation is omitted from three cipher access-restriction queries. This allows members with revoked or not-yet-confirmed status to maintain read, write, delete, a...

CVE-2026-95814: Incorrect Authorization

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...

CVE-2017-3730

CVE-2017-3730 OpenSSL CVE-2017-3730 概念実証 OpenSSH をプロキシとして使用し、DH 値をその場でパッチする DHE-PSK-WITH-AES-256-GCM-SHA384 のような暗号スイートを使用して SSL サーバーを作成します。ここでは 10.0.2.2 のポート 8899 で実行するとします。 openssh-7.4p1 を取得します パッチを適用します ビルドします 次のように実行します: root@kitploit: ./ssh -vvv -N -D 1085 -o TCPKeepAlive=yes -o...

RLSA-2026:67265 Moderate: libkcapi security, bug fix, and enhancement update

libkcapi allows user-space to access the Linux kernel crypto API. This library uses the netlink interface and exports easy to use APIs so that a developer does not need to consider the low-level netlink interface handling. The library does not implement any cipher algorithms. All consumer request...

openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption

A flaw was found in OpenSSL. When processing attacker-supplied Cryptographic Message Syntax CMS data using password-based decryption, an attacker can choose a stream-mode Key Encryption Key KEK cipher. This can trigger a heap out-of-bounds read, potentially causing an application crash and leadin...

libkcapi security, bug fix, and enhancement update

An update is available for libkcapi. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list libkcapi allows user-space to access the Linux kernel crypto API. This...

RockyLinux 10 : libkcapi (RLSA-2026:67267)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67267 advisory. libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries CVE-2026-71225 libkcapi: Memory...

RockyLinux 8 : libkcapi (RLSA-2026:67266)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67266 advisory. libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries CVE-2026-71225 libkcapi: Memory...

Updated libssh2 packages fix security vulnerabilities

Double-Free Heap Corruption via sftpopen. CVE-2026-66032 Integer Underflow DoS via AES-GCM Cipher Negotiation. CVE-2026-66033 Heap Buffer Overflow via ETM Cipher Negotiation. CVE-2026-66035...

MGASA-2026-0402 Updated libssh2 packages fix security vulnerabilities

Double-Free Heap Corruption via sftpopen. CVE-2026-66032 Integer Underflow DoS via AES-GCM Cipher Negotiation. CVE-2026-66033 Heap Buffer Overflow via ETM Cipher Negotiation. CVE-2026-66035...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: lib/crypto: chacha – The permutedstate variable is zeroed before it leaves the scope of the function. Since the ChaCha permutation is invertible, the local variable permutedstate is sufficient to compute the original state, and...