CVE-2026-12802

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

GHSA-JQ35-7PRP-9V3F vulnerabilities

Vulnerabilities for packages: wazuh-manager-fips, openstack-glance-2025.1, openstack-keystone-2025.1, openstack-placement-2025.1, openstack-placement-2026.1-fips, datadog-agent-fips, openstack-glance-2026.1-fips, openstack-keystone-2025.1-fips, ggshield, kserve, openstack-horizon-2026.1,...

CVE-2026-5446

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wcAriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is...

CVE-2025-61727 vulnerabilities

Vulnerabilities for packages: spicedb-fips, terraform-provider-random-fips, supercronic, prometheus-node-exporter-fips, s5cmd, paranoia, nri-jmx, amazon-cloudwatch-agent-fips, temporal, actions-runner-controller-fips, newrelic-nri-kube-events, stakater-reloader, pulumi-kubernetes-operator,...