PT-2026-82107

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP MGMT TIME management id. In the tlv mgmt post recv function, the PTP...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()

A flaw in OpenSSL causes EVPCipher to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

Improper Verification Of Cryptographic Signature

Bouncy Castle is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to OpenPGP AEAD decryption failing to verify the final authentication tag for chunk-aligned data, which allows an attacker to modify encrypted data without detection and potentially bypass...

CVE-2026-55663

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

CVE-2026-63074

A flaw was found in OpenSSL. The CMP Certificate Management Protocol implementation does not clear cached additional certificates when an invalid message is received, leading to excessive memory consumption. This allows a malicious client to repeatedly send requests containing unique extra...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through osslcmpmsgcheckupdate in crypto/cmp/cmpvfy.c. An attacker can drive unbounded memory growth by repeatedly sending CMP messages with unique extraCerts that are rejected during...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference due to insufficient type checking in osslcmpcalcprotection in crypto/cmp/cmpprotect.c. An attacker can crash a CMP server or client by sending a crafted PBM-protected message whose protectionAlg parameter uses t...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the chacha20poly1305cipher and aesocbcipher implementations under providers/implementations/ciphers/. An attacker can forge messages by supplying an empty ciphertext and a bad tag, then...

AZL-97941 CVE-2026-63076 affecting package openssl for versions less than 3.3.7-6

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

Exploit for Improper Isolation or Compartmentalization in Mozilla Firefox

CVE-2026-4692 — content processes can declare themselves in RD...

Exploit for Improper Isolation or Compartmentalization in Mozilla Firefox

CVE-2026-12295 — srcdoc data on a non-about:srcdoc URI Firefo...

CVE-2026-77680: Inefficient Algorithmic Complexity

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

FreeBSD Security Advisory - FreeBSD-SA-26:57.unix

FreeBSD Security Advisory - The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer...

CVE-2026-78679: External Control of File Name or Path

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message...

TencentOS Server 4: pacemaker (TSSA-2026:0865)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0865 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-55663: Insufficient Verification of Data Authenticity

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in ISC BIND [CVE-2026-5946]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in ISC BIND, due to multiple flaws causing an Improper Input Validation CVE-2026-5946. ISC BIND is used as part of our speech utilities. This vulnerability has been addressed. Please read the details for remediation below...

DEBIAN-CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...