CVE-2026-56854

A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security...

19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share...

CVE-2026-56854

The golang.org/x/crypto package is affected by a vulnerability where the source-address critical option in permissions returned by certain authentication callbacks was not validated. Specifically, the check was only enforced for PublicKeyCallback and VerifiedPublicKeyCallback , meaning restrictio...

CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

Incorrect Authorization

Overview golang.org/x/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Incorrect Authorization in NewServerConn, which applied the critical option from the Permissions returned by an authentication callback only on the PublicKeyCallback and...

UBUNTU-CVE-2026-80652

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80709

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

CVE-2026-80652 crypto: ccp - Treat zero-length cert chain as query for blob lengths

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80652

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80651

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to Cryptographic Weakness in IBM Liberty Server ( CVE-2020-36732)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the cryptographic weakness vulnerability Vulnerability Details CVEID:CVE-2020-36732 DESCRIPTION: The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an intege...

CVE-2026-80652: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80651: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...

PT-2026-82952

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto CCP module when handling a PDH export. The system fails to properly account for a zero-length userspace cert chain buffer, which should be treated as a...

MiracleLinux 9 : golang-1.26.7-1.el9_8 (AXSA:2026-1689:09)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1689:09 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Deni...

openSUSE 16: sequoia-sq / sequoia-sq-bash-completion / etc (openSUSE-RU-2026:21658-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- RU-2026:21658-1 advisory. Changes in sequoia-sq: - Legal review Change main license to LGPL-2.0-or-later from GPL-2.0-only LICENSE.txt confirms it Correct Legal-Review-Notice usa...

The vulnerability of the af_alg_pull_tsgl() function in the crypto/af_alg.c module of the Linux kernel’s cryptographic subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the afalgpulltsgl function in the crypto/afalg.c module of the Linux kernel’s cryptographic subsystem is related to the execution of operations outside of memory buffers. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

MiracleLinux 9 : kernel-5.14.0-687.25.1.el9_8 (AXSA:2026-1687:69)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1687:69 advisory. kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling CVE-2026-22979 kernel: rtmutex: Use waiter::task instead of...