2839 matches found
GHSA-WG23-69C2-GJC8 Craft CMS: Passkey login accepts replayed WebAuthn assertions
Craft CMS passkey login accepts WebAuthn requestOptions from the unauthenticated login request body and does not persist the updated credential counter returned by the WebAuthn assertion validator. A captured passkey login request body can therefore be replayed because the old challenge is accept...
Vulnerabilities in the sound/soc/stm/stm32_sai.c and sound/soc/stm/stm32_sai_sub.c modules of the Linux operating system’s SoC audio support, which allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerabilities in the sound/soc/stm/stm32sai.c and sound/soc/stm/stm32saisub.c modules, which support audio functions in Linux-based SoC kernels, are related to errors during link counter updates. Exploiting these vulnerabilities can allow attackers to compromise the confidentiality,...
CVE-2026-71225
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...
UBUNTU-CVE-2026-71225
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...
CVE-2026-71225
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...
CVE-2026-71225 Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...
CVE-2026-71225
CVE-2026-71225 (libkcapi) : A flaw in libkcapi affects one-shot symmetric cipher operations for inputs over 64 KiB in stateful modes (CTR, CBC). The IV is incorrectly reused across internal data chunks, which can weaken confidentiality by exposing relationships in encrypted plaintext and may affe...
CVE-2026-71225 Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...
EUVD-2026-53336
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...
CVE-2026-71225
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...
CVE-2026-59644
In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...
DEBIAN-CVE-2026-59644
In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...
UBUNTU-CVE-2026-59644
In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...