Astra Linux – Vulnerability in opensc

A vulnerability was discovered in OpenSC, OpenSC tools, the PKCS11 module, minidrivers, and CTK. The issue arises from the lack of initialization of variables that should be initialized as arguments to other functions, etc...

Astra Linux – Vulnerability in NTP

In NTP versions 4.2.8, 4.2.8p15, and 4.3.x, before 4.3.101, remote attackers could cause a denial of service memory consumption by sending packets. This occurs because memory is not released in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file...

Astra Linux – Vulnerability in libgcrypt20

The ElGamal implementation in Libgcrypt before version 1.9.4 allows plaintext recovery. This occurs because, during interaction between two cryptographic libraries, a dangerous combination of elements arises—specifically, the prime number defined by the receiver’s public key, the generator define...

Astra Linux – Vulnerability in Munge

MUNGE is an authentication service for creating and validating user credentials. From version 0.5 to 0.5.17, local attackers could exploit a buffer overflow vulnerability in MUNGE the authentication daemon to leak cryptographic key material from process memory. With the leaked key material,...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mac80211: fixed a use-after-free in CCMP/GCMP RX. When PN checking is performed in mac80211, for fragmentation purposes, we need to copy the PN into the RX struct so that it can be used later for comparison. This is reflected in...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A null pointer dereference flaw was discovered in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configurations, which could allow a local user to crash the system or escalate their...

Astra Linux – Vulnerability in opensc

A flaw was discovered in OpenSC packages that could allow for a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length PIN is passed. This issue poses a security risk, especially for OS...

CVE-2026-87802 Apache Syncope: SRA OAuth2 JWT signature verification bypass

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA. This issue...

CVE-2026-25832

A flaw was found in Mbed TLS. The Transport Layer Security TLS 1.3 client accepts a HelloRetryRequest that selects a cryptographic group not advertised by the client. This vulnerability could allow a remote attacker to cause a low integrity impact. Mitigation Mitigation for this issue is either n...

CVE-2026-54155: Improper Verification of Cryptographic Signature

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcuaserver.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session...

PT-2026-91595

A cryptographic issue was addressed with improved integrity checks. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An attacker in a privileged network position may be able to modify network traffic...

CVE-2026-87802: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA. This issue...

CVE-2026-90510 dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

CVE-2026-90510

dromara orion-visor (up to version 2.5.7) contains a hard-coded AES cryptographic key in the HostKeyServiceImpl.encryptKey function within the asset-service module. This CWE-321 flaw allows a remote attacker, with no privileges or user interaction, to decrypt SSH private keys and host passwords s...

CVE-2026-90510 dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

CVE-2026-90510: Use of Hard-coded Cryptographic Key

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

libsignal v0.102.2

Overview libsignal contains platform-agnostic APIs used by the official Signal clients and servers, exposed as a Java, Swift, or TypeScript library. The underlying implementations are written in Rust: libsignal-protocol: Implements the Signal protocol, including the Double Ratchet algorithm. A...

CVE-2026-89172 Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms

Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6...

CVE-2026-89172

Microchip AN1044, AN953, and SW300052 cryptographic algorithms are subject to an improper protection of physical side channels vulnerability. Affected versions: AN1044 through A, AN953 through A, and SW300052 through 2.6. The attack requires physical access with high complexity and specific attac...

CVE-2026-89172 Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms

Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6...