69 matches found
PQCrypto-LWEKE
FrodoKEM: Learning with Errors 鍵カプセル化 このCライブラリは、よく研究されたLearning with Errors LWE 問題 1,3 に基づくIND-CCA安全な鍵カプセル化 KEM プロトコルである FrodoKEM を実装しています。LWE問題は、汎用的で「代数的に非構造化された」格子に関する困難性が予想される問題と密接な関係があります。このパッケージにはPythonリファレンス実装も含まれています。FrodoKEM は、量子コンピュータ攻撃に対しても安全であると予想されています。 FrodoKEM は、主に2つのバリアントで構成されています:...
Z-Sigil: A Public-Key Cryptosystem with Chained Selection over a Fiber Bundle of Module-Lattice Keys
Z-Sigil is a public-key cryptosystem in which the plaintext selects successive keys from a fixed module-lattice family. Messages are length-prefixed, zero-padded and divided into 32-byte blocks. Each public vector is a shared public matrix applied to a small secret vector, plus a small error. Key...
CVE-2026-98085
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...
PT-2026-94604
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth L2CAP implementation. The l2cap data member of hci conn is accessed without proper locking within the l2cap disconn ind function, which...
PT-2026-95567
Summary When pqc kyber is built with the opt-in avx2 feature on x86 64, its constant-time conditional-move routine cmov is a no-op: it never performs the copy. That cmov is exactly the step that applies the Fujisaki-Okamoto FO implicit rejection during decapsulation. With it disabled, decapsulati...
PT-2026-95566
Summary cosmian kyber is a fork of Argyle-Software/kyber and inherits a broken constant-time conditional-move routine cmov in its AVX2 backend. When built with the opt-in avx2 feature on x86 64, cmov is a no-op: it never performs the copy. That cmov is the step that applies the Fujisaki-Okamoto F...
EUVD-2026-39570
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...
CVE-2026-6330
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...
CVE-2026-6330 ML-KEM ARM64 NEON ciphertext comparison only compares half of the input
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...
PT-2026-52560
Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description The AVX2-optimized ML-KEM implementation contains a logic error in the mlkem cmp avx2 function during the Fujisaki-Okamoto transform. In ML-KEM-1024 decapsulation, the constant-time ciphertex...
CVE-2026-6330: Use of a Broken or Risky Cryptographic Algorithm
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...
PT-2026-52603
Name of the Vulnerable Software and Affected Versions ML-KEM affected versions not specified Description An issue exists in the ARM64 NEON ciphertext comparison where only half of the input is compared. This failure breaks the implicit rejection of the Fujisaki-Okamoto transform—a method used to...
AZL-90374 CVE-2026-53090 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ldabs,ind failure path analysis in subprogs Usage of ldabs,ind instructions got extended into subprogs some time ago via commit 09b28d76eac4 "bpf: Add abnormal return checks.". These are only allowed in subprograms when...
CVE-2026-53090: Incorrect Check of Function Return Value
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ldabs,ind failure path analysis in subprogs Usage of ldabs,ind instructions got extended into subprogs some time ago via commit 09b28d76eac4 "bpf: Add abnormal return checks.". These are only allowed in subprograms when...
@ind-rcg/generator (>=262.1002.0-beta.2, <=264.1004.0-beta.1), @ind-rcg/modeler-sfdx-cli-plugin (>=262.1002.0-beta.4, <=264.1004.0-beta.4) +2 more potentially affected by CVE-2026-26801 via pdfmake (>=0.3.0-beta.2, <=0.3.2)
pdfmake NPM version =0.3.0-beta.2, =262.1002.0-beta.2, =262.1002.0-beta.4, =262.1002.0-beta.3, =1.0.0, =2.3.0 Source cves: CVE-2026-26801 Source advisory: OSV:GHSA-WP52-R2FP-4VMR...
CVE-2026-0110
In MMDATAIND of cnNrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Google Pixel 安全漏洞
The Google Pixel is a smartphone produced by Google Inc. The Google Pixel has a security vulnerability, which stems from memory corruption in the MMDATAIND component of cnNrSmMsgHdlrFromMM.cpp. This vulnerability may lead to remote privilege escalation...
UBUNTU-CVE-2025-71139
In the Linux kernel, the following vulnerability has been resolved: kernel/kexec: fix IMA when allocation happens in CMA area Bug description When I tested kexec with the latest kernel, I ran into the following warning: 40.712410 ------------ cut here ------------ 40.712576 WARNING: CPU: 2 PID:...
Malicious code in superb_hedgehog_blue-67 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 760a571948803bafdf742b5f3d2150efa5cb504b777b2ac559aa1fce89f725a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...