GHSA-46Q3-7GV7-QMGG vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, logstash, ruby3.2-rails, truffleruby, kube-fluentd-operator, kube-logging-operator, gitlab-rails-ce, ruby3.4-rails, ruby3.3-rails, jruby, logstash-fips...

GHSA-8P34-64R3-MWG8 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, logstash, ruby3.2-rails, truffleruby, kube-fluentd-operator, kube-logging-operator, gitlab-rails-ce, ruby3.4-rails, ruby3.3-rails, jruby, logstash-fips...

CVE-2026-47241 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, logstash, ruby3.2-rails, truffleruby, kube-fluentd-operator, kube-logging-operator, gitlab-rails-ce, ruby3.4-rails, ruby3.3-rails, jruby, logstash-fips...

GHSA-C4FP-CXRR-MJ66 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, logstash, ruby3.2-rails, truffleruby, kube-fluentd-operator, kube-logging-operator, gitlab-rails-ce, ruby3.4-rails, ruby3.3-rails, jruby, logstash-fips...

CLEANSTART-2026-XW33274 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

GHSA-QPGP-93VX-G8V8 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, logstash, gitlab-rails-ce, gitlab-cng, logstash-fips...

CVE-2026-47737 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, logstash, gitlab-rails-ce, gitlab-cng, logstash-fips...

CVE-2026-47736 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, logstash, gitlab-rails-ce, gitlab-cng, logstash-fips...

Linux Distros Unpatched Vulnerability : CVE-2026-42770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: When EVPPKEYderivesetpeer is called with a DHX X9.42 peer key, the peer key is not properly checked for the subgroup membership. Impact summary: ...

Linux Distros Unpatched Vulnerability : CVE-2026-42764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation...

EUVD-2026-35474

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1mbstringncopy can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In...

EUVD-2026-35484

Issue summary: An attacker-controlled CMP Certificate Management Protocol server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server or acti...

EUVD-2026-35481

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial ...

ALPINE-CVE-2026-42770

Issue summary: When EVPPKEYderivesetpeer is called with a DHX X9.42 peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r a small prime factor of the cofacto...

CVE-2026-42770

Issue summary: When EVPPKEYderivesetpeer is called with a DHX X9.42 peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r a small prime factor of the cofacto...

CVE-2026-42764

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial ...

CVE-2026-42765

Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A NULL pointer dereference can...

CVE-2026-45447 Heap Use-After-Free in the PKCS7_verify() Function

Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS7 or S/MIME signed...

CVE-2026-42770

CVE-2026-42770 affects OpenSSL FIPS modules (4.0, 3.6, 3.5, 3.4, 3.0) and related deployments using EVP_PKEY_derive_set_peer() with DHX/X9.42 keys. The vulnerability arises when the subgroup check Y^q ≡ 1 (mod p) uses the peer’s q instead of the local key’s q, allowing a malicious X9.42 peer to c...

CVE-2026-42770 FFC-DH Peer Validation Uses Attacker-Supplied q

Issue summary: When EVPPKEYderivesetpeer is called with a DHX X9.42 peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r a small prime factor of the cofacto...