CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

EUVD-2026-52660

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

CVE-2026-60007

CVE-2026-60007 affects Eclipse Milo versions 0.6.0 through 1.1.4, where username-token processing reveals distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This enables a network-accessible, on-path attacker who captures a victim’s Basic128Rsa15-encrypt...

CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Oracle Peoplesoft_Enterprise_Hcm_Human_Resources

--- CVE-2026-22006 – XSLT Server‑Side Injection via xsl:scr...

PYSEC-2026-3552 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summary pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An...

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summarypkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported theoutcome of decrypting a RecipientInfo's encryptedKey in severaldistinguishable ways, one of which disclosed the exact length recovered from theRSA operation. The same distinction was also observable by timing. Anapplicatio...

glibc security fix update

2.28-251.0.4.38 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi Oracle history: May-26-2026 Cupertino Miranda - 2.28-251.0.4.37 - Forward port of Oracle patches Reviewed-by: David Faust May-7-2026 Cupertino Miranda - 2.28-251.0.4.34 - Forward port of Oracle patches Reviewed-by: Jos...

PT-2026-73702

TuxCare rebuilt yajra/laravel-datatables-oracle to address 1 CVE. Fixed in 10.11.4-p1+tuxcare...

PT-2026-73695

TuxCare rebuilt yajra/laravel-datatables-oracle to address 1 CVE. Fixed in 9.21.2-p1+tuxcare...

Oracle Linux 9 : frr10 (ELSA-2026-49607)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49607 advisory. - Fix CVE-2026-37460: improve packet parsing for EVPN and ENCAP/VNC Tenable has extracted the preceding description block directly from the Oracle Linux securi...

PT-2026-67696

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 0.6.0 through 1.1.4 Description Username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures. This allows an on-path attacker who captures a victim's...

thunderbird security update

140.13.0-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 140.13.0 - Add OpenELA debranding 140.13.0-1 - Update to 140.13.0 ESR...

thunderbird security update

140.13.0-1.0.1 - Fix prefs for new nss Orabug: 37079820 - Add Oracle prefs file 140.13.0 - Add OpenELA debranding 140.13.0-1 - Update to 140.13.0 ESR...

kernel security, bug fix, and enhancement update

6.12.0-211.42.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

kernel security update

5.14.0-687.33.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

Oracle Linux 10 : nodejs-nodemon (ELSA-2026-48032)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-48032 advisory. 3.1.14-2 - Regenerete sources. 3.1.14-1 - Update to version 3.1.14 3.0.3-7 - revert of ce0df1a 3.0.3-6 - deps: revert letting nodemon work with any node Tenab...

Oracle Linux 10 : firefox (ELSA-2026-47101)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-47101 advisory. 140.13.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding...