GHSA-F5GF-2CJ8-52G2 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...

CVE-2026-64798

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

EUVD-2026-47809

Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

CVE-2026-64798

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

CVE-2026-64798

Summary: CVE-2026-64798 affects the Joomla Extension from regularlabs.com, specifically the IP login extension. The root cause is the use of a non-cryptographic random generator with insufficient entropy to generate persistent URL login keys. Impact: high confidentiality and integrity risk for lo...

CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

DEBIAN-CVE-2026-16615

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

CVE-2026-16615

The CVE affects librest where the PKCE implementation relies on GLib’s GRand PRNG, which is cryptographically insecure. This leads to insufficient entropy in the code verifier, enabling an attacker to reverse‑engineer the PRNG seed and predict or reconstruct the code verifier, thereby bypassing P...

CVE-2026-16615

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

PT-2026-63509

Name of the Vulnerable Software and Affected Versions Joomla Extension - regularlabs.com - IP login extension affected versions not specified Description The IP login extension generates persistent URL login keys using a non-cryptographic random generator with insufficient entropy, which can lead...

PT-2026-63554

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description Dompdf is susceptible to a Denial of Service DoS attack via resource exhaustion. An unauthenticated remote attacker can crash the PHP process by submitting a specially crafted HTML document containing ...

Security Bulletin: This Power System update is being released to address CVE-2026-4932

Summary A firmware issue was identified where the generated AES key used to initialize the Transparent Memory Encryption TME hardware has weakened encryption strength. Vulnerability Details CVEID:CVE-2026-4932 DESCRIPTION: PowerVM Hypervisor could allow an attacker with physical access to the...

USN-8574-1: Linux kernel (GCP FIPS) vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

MGASA-2026-0286 Updated perl-CGI-Session package fixes a security vulnerability

The updated package fixes a security vulnerability: CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. CVE-2026-56016...

Updated perl-CGI-Session package fixes a security vulnerability

The updated package fixes a security vulnerability: CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. CVE-2026-56016...

USN-8567-1 linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577

The CVE-2026-13577 entry affects Dancer2 for Perl up to version 2.1.0. When secure PRNG sources (Math::Random::ISAAC::XS, Crypt::URandom) are unavailable, Dancer2::Core::Role::SessionFactory::generate_id falls back to a low-entropy, rand-derived session id. The fallback is computed from a SHA-1 h...

CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...