15024 matches found
Denial of Service (DoS)
Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Denial of Service DoS. Go Vulnerability Report:Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been...
CVE-2026-73567
creationtimestamp| type| source ---|---|--- 2026-08-13 18:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msyb2gigt42p 2026-08-13 18:35:13+00:00| published-proof-of-concept| https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-vh45-f885-3848...
CVE-2026-73567
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...
CVE-2026-73567 sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...
CVE-2026-73567
Summary: The vulnerability affects the sm-crypto library (SM2/SM3/SM4) prior to version 0.5.0. The default Node.js key generation path for sm2.generateKeyPairHex() relied on a module-wide SecureRandom seeded from Math.random() and Date to an ARC4 stream because window.crypto.getRandomValues was u...
CVE-2026-73567 sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...
EUVD-2026-58182
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...
MAL-2026-13938 Malicious code in @kolbo/mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4967e165bfca294b333ff71265b77d931215a540b48158d2050a4a516ca51e7c src/auth.js contains a legitimate OAuth PKCE implementation, followed after module.exports by a top-level async IIFE that runs when the file is...
CVE-2026-73576
In Zimbra Collaboration ZCS before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with...
Malicious Package
Overview bs58-15 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
CVE-2026-68453
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in ccacipher2protkey Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken functions. Additionally check in ccagencipherkey for possible underflow...
UBUNTU-CVE-2026-68453
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in ccacipher2protkey Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken functions. Additionally check in ccagencipherkey for possible underflow...
CVE-2026-68453
CVE-2026-68453 affects the Linux kernel, s390/zcrypt: a buffer over-read/under-run was possible due to insufficient validation of user-controlled length fields in CCA token structures (cca_check_sec*token() and related key handling). The fix enforces that the key buffer length is at least the tok...
CVE-2026-68453 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in ccacipher2protkey Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken functions. Additionally check in ccagencipherkey for possible underflow...
CVE-2026-68453 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in ccacipher2protkey Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken functions. Additionally check in ccagencipherkey for possible underflow...
cryptohackfirm — Updated!
Cryptohack A semi-secure, hacker-friendly hardware crypto wallet on the hip-badge ESP32-C3 platform with the onboard ATECC608B secure element. Signs transactions for BTC , ETH + 8 EVM chains, SOL , and XMR with an on-device SIGN screen the user has to approve before any private key touches the...
CVE-2026-16459
Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...
CVE-2026-16459
Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...
CVE-2026-16459 Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto
Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...
CVE-2026-16459
CVE-2026-16459 : Padding oracle timing side-channel vulnerability in Oberon Microsystems’ Oberon PSA Crypto library. All versions from 1.0.0 up to, but not including, 2.1.1 are affected. An attacker can recover plaintexts by measuring execution time during RSA PKCS#1 v1.5 decryption. The public d...