CVE-2026-64305: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with servicelock The servicetable list is protected by servicelock when entries are added or removed in adfserviceadd and adfserviceremove, but several functions iterate over the lis...

CVE-2026-64306: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTRDRBG drbgctrgenerate sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it...

CVE-2026-64310: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

Linux Distros Unpatched Vulnerability : CVE-2026-64313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when r01.mhigh is saturated 0xFFFFFFFFFFFFFFFF and addition of lower bit...

PT-2026-64537

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Sensitive key material may be leaked at runtime when CONFIG DYNAMIC DEBUG is enabled. This occurs because the setkey and gen split key functions do not properly guard key hex dumps...

PT-2026-64660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Linux kernel's crypto krb5 implementation. The functions krb5 aead encrypt, krb5 aead decrypt, rfc8009 encrypt, and rfc8009 decrypt set a NULL...

CVE-2026-64316: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use printhexdumpdevel to guard key hex dumps Use printhexdumpdevel for dumping sensitive key material in setkey and gensplitkey to avoid leaking secrets at runtime when CONFIGDYNAMICDEBUG is enabled...

CVE-2026-64304: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser rsahelper.c bounds each CRT component p, q, dp, dq, qinv by the modulus size nsz, but qatrsasetkeycrt allocates half-size DMA buffers keysz / 2 and...

CVE-2026-64439: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecrypt in rfc3961simplified.c and rfc8009encrypt, rfc8009decrypt in rfc8009aes2.c set a NULL completion callback and treat any negative retur...

CVE-2026-64314: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: chacha20poly1305 - validate poly1305 template argument chachapolycreate still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediatel...

PT-2026-64525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qat rsa setkey crt function where DMA buffers are allocated at half the key size key sz / 2. The function right-aligns CRT components p, q, dp, dq, qinv using...

@3w5h/knowledge_query (1.0.30), @3w5h/utils (>=1.0.0, <=1.0.7) +670 more potentially affected by CVE-2026-73567 via sm-crypto (>=0.0.9, <=0.4.0)

sm-crypto NPM version =0.0.9, =1.0.0, =0.1.0, =1.0.0, =4.4.42, =0.0.2, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.7.8-alpha.2 and more Source cves: CVE-2026-73567 Source advisory: OSV:GHSA-VH45-F885-3848...

NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock vulnerability discovered by ? in WordPress Npm sm-crypto versions 0.5.0...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview org.webjars.npm:sm-crypto is a sm-crypto Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG through the generateKeyPairHex path in src/sm2/utils.js. An attacker can recover or predict SM2 private keys and signing nonces b...

@3w5h/knowledge_query (1.0.30), @3w5h/utils (>=1.0.0, <=1.0.7) +670 more potentially affected by unknown CVE via sm-crypto (>=0.0.9, <=0.4.0)

sm-crypto NPM version =0.0.9, =1.0.0, =0.1.0, =1.0.0, =4.4.42, =0.0.2, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.7.8-alpha.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-SMCRYPTO-18601952...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview sm-crypto is a sm-crypto Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG through the generateKeyPairHex path in src/sm2/utils.js. An attacker can recover or predict SM2 private keys and signing nonces by causing a...

CVE-2026-64208

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

CVE-2026-64208 crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

CVE-2026-64208

Summary : CVE-2026-64208 affects the Linux kernel’s crypto/krb5 and AF_RXRPC path. The root cause was missing pre-decrypt/pre-verify length checks, now fixed by updating the krb5 crypto library to provide facilities for prechecking message length and by applying this in AF_RXRPC to validate DATA ...

Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2d9d6dd18d56c6ef8303bc90a0254383b3a7b0f202f5e50b7a1c6ceafd77f7 On import karpatkit, the top-level init.py invokes compat.check which spawns a daemon thread that collects os.environ, the Kubernetes service-account...