Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to cryptography

Summary cryptography is used by IBM Cloud Pak for Data System 1.0 as a Python package providing cryptographic primitives and recipes for secure communications. Multiple vulnerabilities affect the cryptography package. CVE-2024-12797 involves missing error reporting in RFC7250 Raw Public Key RPK...

kernel security, bug fix, and enhancement update

5.14.0-687.20.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

CVE-2026-46354

Summary: A PKCS#7 signature bypass in Coder (Coder v2 before patches) allows unauthenticated token theft via Azure instance identity. The issue stems from azureidentity.Validate() validating only the signer certificate chain, not the signature itself, enabling forged PKCS#7 envelopes containing a...

Insecure Default Initialization of Resource

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource in the oidcProvider. An attacker can gain unauthorized access or impersonate users by exploiting insecure...

Security Bulletin: QRadar App SDK for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar App SDK has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-39892 DESCRIPTION:...

PYSEC-2026-1536 py-libp2p is vulnerable to DoS attacks through use of large RSA keys

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...

CVE-2026-14969

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

PYSEC-2026-1284 Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt. If you are...

3lc (>=2.3.84, <=2.18.0), 3lc-ultralytics (>=0.1.0, <=0.1.5) +1833 more potentially affected by CVE-2024-12797 via cryptography (>=42.0.0, <=44.0.0)

cryptography PYPI version =42.0.0, =2.3.84, =0.1.0, =0.1.0, =2.3.57, =0.1.0, =0.4.0, =0.1.0, =1.1.1, =0.2.0, =0.1.0, =0.1.2, =1.7.0, =1.7.2 and more Source cves: CVE-2024-12797 Source advisory: OSV:PYSEC-2026-1284...

Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt.If you are...

Important: Red Hat Security Advisory: buildah security update

An update for buildah is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

sdc-cryptography (0.2.3), yesaide (1.4.4) potentially affected by CVE-2024-28102 via jwcrypto (0.5.0)

jwcrypto PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on jwcrypto and may be impacted: - sdc-cryptography 0.2.3 - yesaide 1.4.4 Source cves: CVE-2024-28102 Source advisory: OSV:PYSEC-2026-1484...

sdc-cryptography (>=0.1.0, <=0.2.2), yesaide (>=1.1.4, <=1.2.1) potentially affected by CVE-2024-28102 via jwcrypto (0.4.0)

jwcrypto PYPI version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on jwcrypto and may be impacted: - sdc-cryptography =0.1.0, =1.1.4, =1.2.1 Source cves: CVE-2024-28102 Source advisory: OSV:PYSEC-2026-1484...

certbot-pinned (0.17.0), dcoscli (>=0.5.4, <=0.6.1) potentially affected by CVE-2023-50782 via cryptography (2.0.2)

cryptography PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - certbot-pinned 0.17.0 - dcoscli =0.5.4, =0.6.1 Source cves: CVE-2023-50782 Source advisory: OSV:PYSEC-2026-1283...

apputils-config (>=2.0.0, <=2.0.1.dev13), burstable (>=0.2.5rc2, <=0.2.6) +32 more potentially affected by CVE-2023-50782 via cryptography (3.0.0)

cryptography PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - apputils-config =2.0.0, =0.2.5rc2, =0.13.0, =3.16.0.dev2, =0.8.0, =0.0.1, =0.0.2, =11.0.0b3, =0.1.2, =1.0.0, =0.1.9, =0.1.12 and more...

apputils-config (>=2.0.2.dev19, <=2.0.2.dev20), aws-gate (>=0.9.3, <=0.11.0) +43 more potentially affected by CVE-2023-50782 via cryptography (3.3.1)

cryptography PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - apputils-config =2.0.2.dev19, =0.9.3, =0.1.1, =1.1.0, =1.2.3, =3.26.0, =0.1.1, =21.1.0, =0.1.0, =0.0.1, =0.2.0, =0.2.8 and more Source...

acmetk (0.0.2), aioasuswrt (1.3.3) +137 more potentially affected by CVE-2023-50782 via cryptography (3.3.2)

cryptography PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - acmetk 0.0.2 - aioasuswrt 1.3.3 - ais-dom =2021.3.0b4, =1.6.0, =10.0.0, =1.10.0, =1.8.0, =2.20.0, =2.20.0, =1.0.1, =0.3.27, =0.5.6, =0.8...

activedirectoryenum (>=0.4.0, <=0.4.6), adversarial-labeller (0.1.8) +117 more potentially affected by CVE-2023-50782 via cryptography (2.8.0)

cryptography PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - activedirectoryenum =0.4.0, =0.1.2, =0.105.2b1, =5.0.3, =0.6.1, =1.0.0.104260, =0.0.2, =1.1.0, =4.10.0, =4.10.0, =4.10.0, =4.10.0,...

travis-encrypt (>=0.0.1, <=0.3.2) potentially affected by CVE-2023-50782 via cryptography (1.5.0)

cryptography PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - travis-encrypt =0.0.1, =0.3.2 Source cves: CVE-2023-50782 Source advisory: OSV:PYSEC-2026-1283...

moca (0.3.3), oraclebmc (>=1.1.0, <=1.1.1) +2 more potentially affected by CVE-2023-50782 via cryptography (1.5.2)

cryptography PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - moca 0.3.3 - oraclebmc =1.1.0, =2.1.0, =2.1.3 - teamvault 0.6.1 Source cves: CVE-2023-50782 Source advisory: OSV:PYSEC-2026-1283...