EUVD-2026-56238

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace...

Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-596p-6jv8-775v. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and...

CVE-2026-6726 An information leakage vulnerability in the TCG TPM 2.0 reference code.

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

EUVD-2026-56224

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

CVE-2026-6726

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

CVE-2026-6726

CVE-2026-6726 is an information leakage vulnerability in the TCG TPM 2.0 reference code (VRT0010). It allows a local attacker with elevated privileges to obtain credentials from a TPM-aware CA for a falsified TPM key—such as an Attestation Key , DevID Key , or TLS authentication key —enabling the...

CVE-2026-6727 CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

CVE-2026-6727 CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

EUVD-2026-56223

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation of the TCG TPM 2.0 reference code . A privileged local attacker with access to the TPM command interface can exploit timing discrepancies to recover information, potentially allowing the decryption of ciphertexts...

CVE-2026-51583

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

CVE-2026-12074 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-XH95-F55M-82FW vulnerabilities

Vulnerabilities for packages: open-webui...

Security update for erlang26

This update for erlang26 fixes the following issues: CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. CVE-2026-42790: Name...

SUSE-SU-2026:3579-1 Security update for erlang26

This update for erlang26 fixes the following issues: - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. - CVE-2026-42790:...

PowerShell Information Disclosure Vulnerability

Server-side request forgery ssrf in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network...

Microsoft SharePoint Server Spoofing Vulnerability

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-72782

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...