CVE-2026-72700

The getgrav/grav-plugin-login Composer plugin (used by Grav CMS ) before version 3.9.1 compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because...

CVE-2026-72700 Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...

CVE-2026-72701: Observable Timing Discrepancy

Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce that uses non-constant-time string comparison with the === operator instead of hashequals for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through...

PT-2026-81144

Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce that uses non-constant-time string comparison with the === operator instead of hash equals for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through...

CVE-2026-72700: Observable Timing Discrepancy

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...

PT-2026-81143

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash equals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...

pam security update

1.6.1-9.1 - pamuserdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704...

PT-2026-81863

Name of the Vulnerable Software and Affected Versions Punk::Plugin::TOTP versions prior to 0.05 Description The software incorrectly validates recovery codes during the two-factor authentication challenge. The totp use recovery function searches the recovery model for a submitted code's digest...

The vulnerability of the rxrpc_post_response() function in the net/rxrpc/conn_event.c module exposes session sockets supported by the RxRPC support in the Linux operating system, allowing a attacker to cause a service failure.

The vulnerability of the rxrpcpostresponse function in the net/rxrpc/connevent.c module, which is part of the RxRPC session support in Linux kernel, is related to incorrect comparisons when using erroneous factors. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2026-53525

A flaw was found in WeeChat, a free chat client. The relay authentication mechanism uses a non-constant-time comparison when verifying password hashes. This vulnerability allows a remote attacker to exploit subtle timing differences during the authentication process. By analyzing these timing...

Astra Linux – Vulnerability in libsoup2.4

The fix for CVE-2026-2443 was revised in a subsequent commit, where specific overflow checks were replaced with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, resulting i...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing The sofparsetokensets function reads array-size while iterating over the topology private data. The loop condition only checks whether some data remains; therefore, a...

CVE-2026-53583

A flaw was found in libgit2, a C library for Git functionality. An inverted comparison in the OpenSSL backend's certificate verification logic, specifically when handling IP-literal hosts and certificate IP SubjectAltNames, allows a network attacker to intercept HTTPS connections. By presenting a...

SUSE-SU-2026:3703-1 Security update for the Linux Kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.121 fixes various security issues: The following security issues were fixed: - CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1269284. - CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT...

SUSE CVE-2026-74679

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

SUSE CVE-2026-74681

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen - the bulk OUT endpoint size. Both are taken independent...

CVE-2026-74681

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

CVE-2026-74681 usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

CVE-2026-74681

CVE-2026-74681 is a bug in the Linux kernel usbio driver (under drivers/usb/misc/). In usbio_bulk_msg(), the EMSGSIZE check incorrectly compares ibuf_len (the bulk IN/receive buffer size) against txbuf_len (the bulk OUT endpoint size) instead of rxbuf_len. Both values are set independently from d...

EUVD-2026-64368

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...