PT-2026-82939

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortify panic Fix a runtime assertion in setup xor mapping. Fortify complains that it is potentially overflowing the xormaps array per counted bynr maps. Quiet the false positive by initializing @nr maps earlier...

PT-2026-82940

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A runtime assertion issue exists in the cxlctl get supported features function. The system triggers a fortify panic due to a false positive buffer overflow detection where the entries...

PYSEC-2026-3779

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

CVE-2026-81703

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

EUVD-2026-67059

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

EUVD-2026-67037

opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...

CVE-2026-81681

openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 advertise a portable USB workspace as an "Encrypted USB Workspace" with AES-256-GCM encryption and write a marker declaring it encrypted, but the workspace directory is actually stored in cleartext — the derived encryption key is neve...

CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...

CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...

CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...

EUVD-2026-67141

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...

BELL-CVE-2026-74706 CVE-2026-74706 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-74699 CVE-2026-74699 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-52492 CVE-2026-52492 does not affect BellSoft software

Bulletin has no description...

PT-2026-82604

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate the encryption status of embedded post-quantum cryptography PQC private keys within file metadata. This allows attackers to create files containing unencrypted...

DRUPAL-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098746)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098746 advisory. In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotifygetmarksafe may return false for a mark...

Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

CVE-2026-55618

eml_parser is a Python module for parsing .eml files. Prior to 3.0.2 , the clean_found_uri function in parser.py validates potential URL strings before unescaping HTML entities for colon, slash, or period characters. As a result, valid encoded URLs and their hostnames are rejected and omitted fro...

Insecure Default Initialization Of Resource

org.openidentityplatform.openam, openam-core is vulnerable to Insecure Default Initialization of Resource. The vulnerability is due to the default configuration setting the iPlanetDirectoryPro SSO cookie with HttpOnly=false while also using the cookie as a CSRF token in OAuth/OIDC flows, which...