CVE-2026-71890

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

CVE-2026-71890

Bouncy Castle for Java versions before 1.86 are vulnerable to an authorization flaw in the MLS (RFC 9420) protocol implementation. The org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals method fails to verify that a Remove proposal in an external commit belongs to the joiner. Thi...

CVE-2026-71890 MLS external commit can remove an arbitrary group member

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

EUVD-2026-92006

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

CVE-2026-71890 MLS external commit can remove an arbitrary group member

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

proposal-symbol-proto

Mitigación de la contaminación de prototipos / Symbol.proto Autores : Santiago Díaz Google Champion : Shu-yu Guo Google Etapa : 1 Índice Descripción del problema Acción fantasmagórica a distancia Ataques solo de datos Problemas con freeze, seal y preventExtensions El error de sobrescritura...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/smc: Check smcdv2extoffset when receiving a proposal message. When receiving a proposal message from the server, the smcdv2extoffset field in the proposal message comes from the remote client, and cannot be fully trusted. Onc...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107307)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107307 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: check ipareaoffset and ipv6prefixescnt when receiving proposal msg When receiving propos...

CVE-2026-57445

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal beneficiary payout paths in StreamingEscrow preserve depositAmount...

CVE-2026-53924

Gardens v2 , a modular on-chain governance framework, contains a logic flaw in the StreamingEscrow contract. While claim() correctly rejects withdrawals during a dispute, the permissionless syncOutflow() path performs the same excess-balance transfer without checking the disputed state . After a ...

CVE-2026-53924 Gardens v2: Permissionless syncOutflow bypasses streaming proposal disputes

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. Prior to 0xc9d4e0dacd937364793278180551e59d93cd43f9, StreamingEscrow.claim correctly rejects withdrawals while an escrow is...

JLSEC-2026-1358 Wasmtime has host data leakage with 64-bit tables and Winch

Impact Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive...

CVE-2026-45414

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

CVE-2026-45414

Decidim CVE-2026-45414 describes a JWT binding flaw in multi-tenant deployments: a JWT issued for one organization can be replayed against another organization’s API to read participantDetails and access the proposal.answer mutation. Affected are pre-0.31.5 and 0.32.0.rc1 before 0.32.0.rc2; the i...

CVE-2026-45414 Decidim: JWT-backed authentication can be replayed across organizations

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

CVE-2026-45414 Decidim: JWT-backed authentication can be replayed across organizations

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

EUVD-2026-54230

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

CVE-2026-45414: Authorization Bypass Through User-Controlled Key

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

EUVD-2026-49061

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes allocation of resources. The attack may be initiated remotely. The pull...

GHSA-R3V7-5X4C-C69Q Decidim: JWT-backed authentication can be replayed across organizations

Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that...