CVE-2026-9205

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

CVE-2026-9205

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

CVE-2026-9205

CVE-2026-9205 affects IBM Langflow OSS. A weakness in the cryptographic key derivation in the ensure_fernet_key() function could expose protected secrets and compromise confidentiality and integrity. The NVD and IBM advisories list Langflow OSS versions 1.0.0–1.10.3 as affected, with a remediatio...

CVE-2026-9205 Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

CVE-2026-13586

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

UBUNTU-CVE-2026-13586

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...

UBUNTU-CVE-2026-58063

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-13586 PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

EUVD-2026-52140

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-13586 PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-58063

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-58063

The CVE-2026-58063 issue affects Bouncy Castle for Java's BCFKS keystore loading, where unbounded KDF cost can be triggered by an untrusted file. Affected products/versions are: BC Java before 1.85; BC Java LTS before 2.73.12; and BC-FJA (FIPS) before bc-fips 1.0.2.7 (1.0.X), 2.0.2 (2.0.X), and 2...

CVE-2026-58063

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-15055 PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input

In Bouncy Castle for Java before 1.85, PKCS8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

PT-2026-67032

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...