Linux Distros Unpatched Vulnerability : CVE-2026-118768

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocspcheck command requested an OCSP response from a certificate's Authority Informatio...

pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

Summary The pypi-publish actionpypi-publish versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. pypi-publish:...

GHSA-5XJX-3W67-W9X9 pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

Summary The pypi-publish actionpypi-publish versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. pypi-publish:...

CVE-2026-118696

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and...

EUVD-2026-114244

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and...

CVE-2026-118696

Several JetBrains IDEs including IntelliJ IDEA , PyCharm , PhpStorm , RubyMine , WebStorm , GoLand , Rider , CLion , DataGrip , RustRover , and DataSpell are vulnerable because their embedded browser trusted revoked intermediate certificates. This issue affects versions prior to 2026.3, 2026.2.4,...

CVE-2026-118696

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and...

CVE-2026-118696

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and...

CVE-2026-118768

A flaw was found in botan. The command-line utility fails to verify the cryptographic signature and authorization of Online Certificate Status Protocol OCSP responses. An on-path network attacker or malicious responder can exploit this vulnerability by returning a forged response with an invalid...

PT-2026-133725

Name of the Vulnerable Software and Affected Versions IntelliJ IDEA versions prior to 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2 PyCharm versions prior to 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2 PhpStorm versions prior to 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2 RubyMine versions prior...

CVE-2026-118696: JetBrains: In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and…

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and...

GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the serve...

curl: --cert-status with OpenSSL accepts a stapled OCSP response of any age when it lacks nextUpdate (revoked certificate keeps passing)

Summary: curl built with OpenSSL accepts a stapled OCSP "good" response of any age under CURLOPTSSLVERIFYSTATUS --cert-status when the response omits nextUpdate, so a response signed before a certificate was revoked keeps passing the check for as long as the certificate itself is valid. The GnuTL...

curl: GnuTLS + Apple SecTrust discards authenticated OCSP failure

Summary curl 8.23.0 and current master can accept a TLS certificate despite an explicit CURLOPTSSLVERIFYSTATUS=1 / --cert-status requirement when curl uses the GnuTLS backend together with Apple SecTrust. GnuTLS correctly marks an invalid or revoked stapled OCSP response as invalid. Because a...

Public Knowledge Project Open Journal Systems Authorization Issues Vulnerabilities

The Public Knowledge Project Open Journal Systems 3.5.0-5 version has an authorization issue vulnerability. This vulnerability stems from insecure direct object references, allowing journal or subscription administrators to access subscriptions to other journals by providing arbitrary subscriptio...

curl: CVE-2026-111483: GnuTLS accepts non-successful OCSP staples

A vulnerability was identified in curl version 8.22.0 and 8.23.0 when built with GnuTLS. The --cert-status option failed to properly validate stapled OCSP responses. Instead of checking the response status and certificate status within the response, the code only verified that some stapled OCSP...

CLEANSTART-2026-NT44530 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

CVE-2026-42508 affects multiple packages. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

CVE-2026-14316

The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...

Improper Verification of Cryptographic Signature

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

CVE-2026-14316

The boks_sshd software contains a heap buffer overflow vulnerability within its revoked-key error handling path. The root cause is the use of sprintf() to construct a human-readable failure reason into a heap buffer that is insufficiently sized for the final formatted message. This results in dat...