CVE-2025-36591

Dell ECS (versions 3.8.1.0 through 3.8.1.7) and Dell ObjectScale (versions prior to 4.4.0.0) contain a Use of a Broken or Risky Cryptographic Algorithm vulnerability. A high-privileged attacker with local access could potentially exploit this flaw, leading to information exposure . The assigned C...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-25854, CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-25854, CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990 Vulnerability Details CVEID:CVE-2026-25854 DESCRIPTION: Occasional URL redirection to untrusted Site 'Open Redirect' vulnerability i...

kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

A flaw was found in the Linux kernel's crypto QAT QuickAssist Technology module. A race condition exists during the teardown of Virtual Function to Physical Function VF2PF work in the adfdisablesriov function. This allows a concurrently scheduled or already queued worker to attempt to access memo...

kernel: crypto: qat - validate RSA CRT component lengths

A flaw was found in the Linux kernel's QAT QuickAssist Technology crypto module. This vulnerability occurs in the RSA key parser when handling CRT Chinese Remainder Theorem components. An underflow can happen during a memory copy operation if an RSA CRT component is larger than its allocated...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...

kernel: crypto: qat - validate RSA CRT component lengths

A flaw was found in the Linux kernel's QAT QuickAssist Technology crypto module. This vulnerability occurs in the RSA key parser when handling CRT Chinese Remainder Theorem components. An underflow can happen during a memory copy operation if an RSA CRT component is larger than its allocated...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21841-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21841-1 advisory. Changes in hauler: - update vendor.tar to fix: bsc1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: hauler: golang.org/x/crypto/ssh:...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21835-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21835-1 advisory. - CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service bsc1280111. - CVE-2026-56854:...

RHEL 10 / 9 : Red Hat Edge Manager Version 1.2.1 Security Update (Important) (RHSA-2026:68335)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68335 advisory. Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports...

openSUSE 16 Security Update : keybase-client (openSUSE-SU-2026:21846-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21846-1 advisory. Changes in keybase-client: - CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library Add...

CVE-2026-0177

In dosssaesgcm256op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0177

In dosssaesgcm256op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-79148

In dosssaesgcm256op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0177

In dosssaesgcm256op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0177

A vulnerability exists in the do_sss_aes_gcm_256_op function of crypto-aes.c , where a missing bounds check leads to a possible out-of-bounds read . This flaw could result in local information disclosure . Exploitation requires System execution privileges , and no user interaction is necessary. F...

OPENSUSE-SU-2026:21861-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: Update to version 2.100.0, fixing two deadlock issues in the vendored golang.org/x/crypto/ssh library reachable via crafted SSH channel messages CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc1278604: Fix gh api telemetry disableme...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...