CVE-2026-98005 erofs: delimit inode_share cache key components

In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inodeshare cache key components Previously, inodeshare keys were encoded as follows: fingerprint || domainid It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won'...

CVE-2026-98005 erofs: delimit inode_share cache key components

In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inodeshare cache key components Previously, inodeshare keys were encoded as follows: fingerprint || domainid It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won'...

CVE-2026-98005

The Linux kernel contains a vulnerability within the erofs file system regarding the encoding of inode_share cache keys . Previously, keys were encoded as fingerprint || domain_id, which created ambiguity as the fingerprint could be incorrectly parsed as part of a domain ID. The fix involves chan...

EUVD-2026-86658

In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inodeshare cache key components Previously, inodeshare keys were encoded as follows: fingerprint || domainid It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won'...

CVE-2026-98005

In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inodeshare cache key components Previously, inodeshare keys were encoded as follows: fingerprint || domainid It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won'...

CVE-2026-97588

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly When hardware persistently returns -EBUSY after exhausting retries, the error propagates to cryptofinalizerequest. The crypto API's completion wrapper treats -EBU...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-75553

Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key from the affected product...

CVE-2026-75553

Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key from the affected product...

CVE-2026-75553

Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key from the affected product...

CVE-2026-75553

The smartphone application Tohoku Electric Power "Yorisou e Net" , provided by Tohoku Electric Power Company, Incorporated, contains a hard-coded cryptographic key (CWE-321). This vulnerability allows an attacker to retrieve the hard-coded key from the affected product, potentially compromising c...

EUVD-2026-86531

Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key from the affected product...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846 Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846 Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

EUVD-2026-86530

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846

The Keycloak-services component contains a vulnerability where the new Standard Token Exchange V2 feature fails to validate the digital certificate required for mTLS holder-of-key binding . This flaw allows an attacker possessing stolen client credentials to obtain a standard, unrestricted token,...

OESA-2026-4124 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

OESA-2026-4060 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. From 3.0...