CVE-2026-18036

Bouncy Castle for Java versions prior to 1.86 are vulnerable to a timing side-channel attack in the NTRU implementation. The root cause is the use of the % operator in three helpers, leading to integer division where latency depends on the secret operand. Specifically, Polynomial.modQ divides by ...

EUVD-2026-91317

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-18036

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-18036

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

ThinkCMF_getshell

Vulnerabilidad de inclusión de contenido arbitrario en el framework ThinkCMFgetshell Los atacantes remotos pueden ejecutar código arbitrario en el servidor remoto mediante la construcción de paquetes de solicitud específicos, sin necesidad de ningún privilegio. Uso de python: + python...

CVE-2026-18036: Observable Timing Discrepancy

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

RHCOS 4 : OpenShift Container Platform 4.18.56 (RHSA-2026:70614)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70614 advisory. - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 -...

RHEL 7 : freerdp (RHSA-2026:74610)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:74610 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP serve...

RHEL 9 : libvirt (RHSA-2026:74424)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74424 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems...

RHEL 9 : ghostscript (RHSA-2026:74457)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:74457 advisory. The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats...

RHEL 10 : kpatch-patch-6_12_0-211_16_1 and kpatch-patch-6_12_0-211_49_1 (RHSA-2026:72831)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72831 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This pat...

RHEL 9 : kernel (RHSA-2026:74438)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74438 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: RDMA/uverbs: Validate wqesize...

RHEL 9 : Satellite 6.17.12 Async Update (Critical) (RHSA-2026:74505)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74505 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

PT-2026-104440

Name of the Vulnerable Software and Affected Versions postgresql-operator charm versions prior to 1189 arm64 and 1190 amd64 in the dev track 14/edge postgresql-operator charm versions prior to 1216 arm64 and 1217 amd64 in the stable track 14/stable Description The postgresql-operator charm utiliz...

Containing the Autonomous Operator: A Defense-In-Depth Framework and Reference Architecture for Securing AI Agents on Kubernetes

Large language model LLM agents are moving from chat interfaces into infrastructure operations, where they read telemetry, call tools, generate and execute code, and change the state of production Kubernetes clusters. This collapses a boundary that conventional cloud-native security assumes: the...

CVE-2026-104055: Insertion of Sensitive Information into Log File

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

RHEL 8 : gawk (RHSA-2026:73511)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:73511 advisory. The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special- purpose programming language to do...