PT-2026-76629

openssl encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client id to gain authenticated access to keyserver and telemetry APIs...

PT-2026-76634

openssl encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtai...

PT-2026-76628

openssl encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

PT-2026-76633

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0 Description A sandbox escape exists in the IsolatedPluginExecutor component that exposes Python type objects within restricted exec builtins. This allows attackers to traverse the Python class hierarchy...

MiracleLinux 9 : php:8.3 (AXSA:2026-1549:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1549:01 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding...

PT-2026-76635

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0 Description An authentication bypass exists in pqc.py where failures during AES-GCM decryption cause the system to fall back to unauthenticated AES-CTR mode. This allows attackers to modify ciphertext...

PT-2026-76617

openssl encrypt versions before 1.4.0 configure CORS with allow origins set to wildcard and allow credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them...

openSUSE 16 Security Update : snpguest (openSUSE-SU-2026:21579-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21579-1 advisory. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length bsc1270541. - CVE-2026-41678: openssl:...

Important: rust

Issue Overview: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipherupdateinplace in openssl/src/cipherctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVPaes128,192,256wrappad. For a...

Unity Linux 20.1070a Security Update: compat-openssl10 (UTSA-2026-099545)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099545 advisory. There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1STRING but the public...

ROS-20260817-73-0218

The vulnerability of the command-line tool openssl dgst from the OpenSSL library is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker to influence the integrity of the protected information...

Security Bulletin: This Power System update is being released to address CVE-2026-22796

Summary PowerVM relies on OpenSSL to support a range of features, such as virtual TPM, LPM, and other functionalities that require cryptographic operations. This bulletin provides a remediation for the impacted vulnerability, CVE-2026-22796 by upgrading PowerVM and thus addressing the exposure to...

Security Bulletin: This Power System update is being released to address CVE-2026-45447

Summary An authenticated administrator user uploading a specially crafted certificate to the FSP can lead to loss of integrity or remote code execution. Vulnerability Details CVEID:CVE-2026-45447 DESCRIPTION: Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a...

PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext

...

SUSE CVE-2026-56862

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

Security Bulletin: Multiple Vulnerabilities in IBM Bob

Summary Multiple vulnerabilities were addressed in IBM Bob V 2.0.2 Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779. CWE:CWE-770: Allocation of Resources Without Limi...

RLSA-2026:48170 Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in...

RLSA-2026:49914 Low: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

php8.4 security, bug fix, and enhancement update

An update is available for php8.4. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language. PHP attempts to make it easy for...

php security, bug fix, and enhancement update

An update is available for php. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language commonly used with the Apache HTTP...