AlmaLinux 9.2 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.2:CLSA-2026:1788971665)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788971665 advisory. - Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

Rocky Linux 8 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel (crlsa-2026_56131)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202656131 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly fro...

Rocky Linux 8 [CIQ] Security Update: microcode_ctl Multiple Vulnerabilities (crlsa-2021_2308)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20212308 advisory. hw: vt-d related privilege escalation CVE-2020-24489 hw: improper isolation of shared resources in some Intel Processors CVE-2020-24511 hw: observable timi...

Rocky Linux 8 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel (crlsa-2026_0421)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260421 advisory. libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy First- vs Last-Value Wins CVE-2025-14523 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel (crlsa-2026_0422)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260422 advisory. libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy First- vs Last-Value Wins CVE-2025-14523 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel / pam-docs (crlsa-2026_64815)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202664815 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly fro...

AlmaLinux 9.6 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.6:CLSA-2026:1789472351)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789472351 advisory. - Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

Rocky Linux 9.6 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.6:CLSA-2026:1789472351)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789472351 advisory. - Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

CVE-2026-86778

Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting. This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11...

EUVD-2026-89948

Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting. This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11...

CVE-2026-86778: Observable Response Discrepancy

Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting. This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11...

CVE-2026-54872: Observable Timing Discrepancy

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

CVE-2026-54872: Observable Timing Discrepancy

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

PT-2026-102650

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations leaks information about the secret nonce through timing discrepancies...

CVE-2026-54875: Observable Timing Discrepancy

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

Updated pam packages fix a security vulnerability

The updated packages fix a security vulnerability: Linux-PAM pamuserdb Observable Timing Discrepancy in Plaintext Password Comparison. CVE-2026-54411...

MGASA-2026-0461 Updated pam packages fix a security vulnerability

The updated packages fix a security vulnerability: Linux-PAM pamuserdb Observable Timing Discrepancy in Plaintext Password Comparison. CVE-2026-54411...

Security Bulletin: QRadar App SDK for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar App SDK has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION:...

CVE-2026-84717: Observable Response Discrepancy

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

CVE-2026-63132: Observable Timing Discrepancy

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...