wycheproof

Project Wycheproof Project Wycheproof is a community managed repository of test vectors that can be used by cryptography library developers to test against known attacks, specification inconsistencies, and other various implementation bugs. Test vectors are maintained as JSON test vector data, wi...

CVE-2026-98902

A flaw was found in the Linux kernel's RAID5 storage driver. A sequence number comparison issue in stripe batch processing fails to account for 32-bit integer wrapping. During extensive storage write operations, the sequence counter may overflow, causing the system to misidentify newer stripe...

CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in...

CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in...

CVE-2026-115905

The zip library for Rust (through version 9.0.4 ) is vulnerable to a critical parser differential and security control bypass caused by dual-header inconsistencies, often referred to as Zip Cloaking . The root cause resides in src/read/stream.rs, where ZipArchive treats Central Directory File Hea...

CVE-2026-89979

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA Pulse Code Modulation PCM subsystem. A race condition exists where a thread can initiate a PCM start operation while another thread is performing non-atomic PCM operations, such as hardware parameter setup or preparatio...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.32 contains security vulnerabilities. These vulnerabilities stem from the fact that the fields invalidHandle, swapfile, oplockbreakcancelled, offload, and statusfiledeleted in the cifsFileInfo structure share the same byte. When different code paths concurrently updat...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Ceph: Proper snapshot context was provided for the cephzeropartialobject function. The cephzeropartialobject function lacked the correct snapshot context for its OSD write operations, which could lead to inconsistencies in...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with an incorrect size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but certain...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: 1. Regulator: In the core module, the regulatorsupplyaliaslist should be protected using the regulatorlistmutex. The regulatorsupplyaliaslist was accessed without any locking mechanisms in functions like regulatorsupplyalias,...

IBM Aspera Console Unauthorized Access

The vulnerability of the IBM Aspera Console, a web application for managing high-speed data transfer environments, is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.7 contains security vulnerabilities. These vulnerabilities stem from LoongArch BPF JIT’s symbolic expansion of signed ALU32 division/mode division results. As a result, negative 32-bit quotients or remainders are not cleared of their high 32-bit bits in the JIT code,...

STS AssumeRoleWithLDAPIdentity Unauthorized Access

The vulnerability of the endpoint of the STS Security Token Service, which manages MinIO object storage, is related to inconsistencies in response to incoming requests. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Race Condition

Overview django-shop is an A RESTful e-commerce framework based on Django Affected versions of this package are vulnerable to Race Condition in the Purchase Stock Handler process in shop/models/inventory.py. An attacker can cause inconsistent stock levels or unauthorized inventory modifications b...

PT-2026-52650

Name of the Vulnerable Software and Affected Versions Revive Adserver version 6.0.7 Description Stored Cross-Site Scripting XSS occurs in the maintenance-acl-check.php and maintenance-banners-check.php tools. The issue arises when entity names are displayed without proper escaping during the...

CVE-2026-46175

A flaw was found in the Linux kernel's f2fs filesystem. During Foreground Garbage Collection FGGC of node blocks, the system fails to properly clear internal metadata marks. This can lead to filesystem inconsistencies, where the fsck utility may misinterpret the state of migrated data. A local us...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from data competition within the runtime.oss.trigger field in the ALSA pcm oss module, potentially...

CVE-2026-46064

In the Linux kernel, the following vulnerability has been resolved: ibmasm: fix heap over-read in ibmasmsendi2omessage The ibmasmsendi2omessage function uses getdotcommandsize to compute the byte count for memcpytoio, but this value is derived from user-controlled fields in the dotcommandheader...

The Fault in Our Drafts: Vulnerabilities in RPKI Specification and Software

The Resource Public Key Infrastructure RPKI secures the Internet's routing system by defining a complex trust and validation framework for certificates, Route Origin Authorizations ROAs, manifests, and Certificate Revocation Lists CRLs. These mechanisms are specified across dozens of RFCs. This...

JOSE Authlib Information Disclosure

The vulnerability of the JOSE library Authlib implementation for OAuth and OpenID Connect servers is related to the disclosure of information due to incompatibility. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...