Microsoft 365 Admin Center Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...

Security Bulletin: Due to the use of Bouncy Castle Inc. BC-JAVA bcprov IBM webMethods Managed File Transfer is vulnerable to a Covert Timing Channel vulnerability and Use of a Broken or Risky Cryptographic Algorithm vulnerability

Summary Bouncy Castle Inc. BC-JAVA bcprov is used by IBM webMethods Managed File Transfer CVE-2025-14813, CVE-2026-5598, CVE-2026-0636 Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JA...

EUVD-2026-53923

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

CVE-2026-16315 Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

BLAKE3 v1.8.6

BLAKE3 BLAKE3 is a cryptographic hash function that is: Much faster than MD5, SHA-1, SHA-2, SHA-3, and BLAKE2. Secure , unlike MD5 and SHA-1. And secure against length extension, unlike SHA-2. Highly parallelizable across any number of threads and SIMD lanes, because it's a Merkle tree on the...

CVE-2026-62918: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network...

PT-2026-68833

Name of the Vulnerable Software and Affected Versions Microsoft 365 Admin Center affected versions not specified Description Improper verification of cryptographic signatures in the Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network. Recommendations At...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

kernel security, bug fix, and enhancement update

6.12.0-211.43.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Canonicalization Failures As a Recurring Vulnerability Class: Representation Divergence in Cryptographic Systems and Its Avoidance

Cryptographic systems operate on bytes but mean semantic objects. The translation between the two is rarely unique. Where this uniqueness is not enforced, an attack surface opens up as soon as a hash, a signature, replay protection, or consensus identity depends on the representation. The same...

PT-2026-68490

Name of the Vulnerable Software and Affected Versions OMICRON StationGuard versions prior to 4.10 Description A cryptographic timing side-channel vulnerability exists in the backend authentication mechanism. This flaw allows an unauthenticated attacker to forge valid authentication credentials,...

CVE-2026-62873: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-16731: Observable Timing Discrepancy

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

CVE-2026-16315: Observable Timing Discrepancy

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

PT-2026-68835

Name of the Vulnerable Software and Affected Versions Microsoft Teams affected versions not specified Description Improper verification of cryptographic signatures allows an unauthorized attacker to perform spoofing over a network. Spoofing is a technique where a person or program successfully...

Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture

AI agents performing cryptographic operations signing Git commits, authenticating API calls, issuing certificates currently store private keys in software-accessible locations: plaintext files, environment variables, or container memory. Any process with sufficient read privileges can extract the...

Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references. Original Description IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

GHSA-9PW3-X84F-XCWF Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references. Original Description IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

CVE-2026-9205

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

CVE-2026-9201 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application...