CVE-2026-12802

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

GHSA-JQ35-7PRP-9V3F vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1, airflow-core, openstack-placement-2025.2, airflow-postgres-fips, openstack-glance-2025.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.1, openstack-placement-2025.1, netbox-fips, openstack-placement-2026.1,...

CVE-2026-5446

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wcAriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is...

CVE-2025-61727 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider-fips, fluent-operator-fips, aws-load-balancer-controller-fips, kubernetes-csi-external-snapshotter-fips, prometheus-adapter-fips, go-fips, gitaly-fips, polaris-fips, timescaledb-tune, mariadb-operator-fips, grpc-health-probe, net-kourier-fips,...