CVE-2026-80924 crypto: krb5 - use kfree_sensitive() for derived key buffers

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfreesensitive for derived key buffers cryptokrb5prepareencryption and cryptokrb5preparechecksum free the buffer holding the freshly derived keys with plain kfree, leaving the key material behind in the freed...

CVE-2026-80924 crypto: krb5 - use kfree_sensitive() for derived key buffers

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfreesensitive for derived key buffers cryptokrb5prepareencryption and cryptokrb5preparechecksum free the buffer holding the freshly derived keys with plain kfree, leaving the key material behind in the freed...

CVE-2026-80924

This vulnerability affects the Linux kernel 's crypto KRB5 module. The functions crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum() release buffers holding freshly derived Kerberos key material using plain kfree() instead of kfree_sensitive() , leaving sensitive key data in the f...

Linux Distros Unpatched Vulnerability : CVE-2026-80924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: krb5 - use kfreesensitive for derived key buffers cryptokrb5prepareencryption and cryptokrb5preparechecksum free the buffer holding the freshly derived...

PT-2026-89094

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfree sensitive for derived key buffers crypto krb5 prepare encryption and crypto krb5 prepare checksum free the buffer holding the freshly derived keys with plain kfree, leaving the key material behind in the...

Veto v2.3

Veto An open source VirusTotal client for Android Free and open source. Bring your own VirusTotal API key to scan files, links, and installed applications against over 70 engines, built with a Material 3 interface. No accounts, no tracking, no ads. What is Veto? Veto is an Android client for...

GHSA-XVG9-69GF-FJRF Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

EUVD-2026-57321

Material for MkDocs: DOM XSS in search suggestions via query parameter...

adeso (>=0.0.1, <=0.0.4), adze-modeler (0.0.1) +138 more potentially affected by CVE-2026-73295 via mkdocs-material (>=7.2.2, <=9.7.6)

mkdocs-material PYPI version =7.2.2, =0.0.1, =0.0.0, =0.10.0, =0.5.0a1, =0.3.1b1, =0.0.45, =1.6.4b1, =0.1.0, =0.0.34, =0.0.36 and more Source cves: CVE-2026-73295 Source advisory: GHSA-XVG9-69GF-FJRF...

CVE-2026-78609: Incorrect Authorization

Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in t...

CVE-2026-80708

A flaw was found in the Linux kernel's s390/zcrypt module. During the clear key to secure key token import process, an internal buffer used by the ipcprbhelper function was not properly scrubbed after use. This oversight could leave sensitive clear key material in memory. A local attacker could...

SUSE CVE-2026-72103

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

CVE-2026-80708

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in ccaclr2cipherkey The helper function ipcprbhelper uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could lead ...

UBUNTU-CVE-2026-80708

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in ccaclr2cipherkey The helper function ipcprbhelper uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could lead ...

Linux Distros Unpatched Vulnerability : CVE-2026-80708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/zcrypt: Fix missing mem scrub at clear key import in ccaclr2cipherkey The helper function ipcprbhelper uses internal buffer memory for building and...

PT-2026-86692

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in cca clr2cipherkey The helper function ip cprb helper uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could le...

Missing Release Of Resource After Effective Lifetime

Bouncy Castle is vulnerable to Missing Release of Resource after Effective Lifetime. The vulnerability is due to reliance on Java object finalization to zeroise sensitive key material, which can cause pending finalization queues to grow under load, leading to memory exhaustion and prolonged...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the toString process and exception message handling, where raw HPKE private key bytes are included in string representations and error messages. An attacker can obtain sensitive privat...

CVE-2026-76311 Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...

CVE-2026-76312

Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14 are affected by an improper access control flaw in the embedded-report dispatch archive download path. The path fails to enforce the embedded-report authorization boundary and includes sensitive session material in archived searc...