PYSEC-2026-3742

opensslencrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in...

CVE-2026-74900 openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode

opensslencrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain...

CVE-2026-74900 openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode

opensslencrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain...

CVE-2026-74900 openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode

opensslencrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain...

CVE-2026-74900

openssl_encrypt before version 1.4.0 has a flaw in pqc.py: when KEM decapsulation fails, it silently falls back to simulation mode, deriving a deterministic shared secret from just 16 bytes of the private key plus public encapsulated key data. An attacker with those 16 private-key bytes can compu...

PT-2026-76682

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description Users permitted to view group activity but restricted from seeing shared drafts can...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100708)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100708 advisory. In the Linux kernel, the following vulnerability has been resolved: ipc/shm: serialize orphan cleanup with shmnattch updates shmdestroyorphaned walks the shm idr und...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099500)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099500 advisory. An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when...

CVE-2026-75045: Authentication Bypass Using an Alternate Path or Channel

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature...

CVE-2026-55704: Missing Authorization

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

PT-2026-76866

Name of the Vulnerable Software and Affected Versions Onyx versions prior to 3.1.10 Onyx versions prior to 3.2.14 Onyx versions prior to 4.0.0 Description An issue exists where the 'GET /api/mcp/servers' and 'GET /api/mcp/servers/persona/persona id' endpoints expose the OAuth Authorization header...

CVE-2026-74900: Unchecked Error Condition

opensslencrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain...

PT-2026-76634

openssl encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtai...

PT-2026-121116

Уязвимость обработчика JavaScript-сценариев V8 браузеров Google Chrome и Microsoft Edge связана с недостаточной проверкой состояния совместно используемого ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании с помощью специально созданн...

Linux kernel DoS

The vulnerability in the drivers/md/md-bitmap.c component of the Linux kernel system is related to concurrent execution using shared resources with improper synchronization. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Linux kernel ICMP DoS

The vulnerability in the net/ipv4/icmp.c component of the Linux kernel is related to insufficient validation of the state of shared resources. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099970)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099970 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Make sure resource...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099932)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099932 advisory. In the Linux kernel, the following vulnerability has been resolved: ipc/shm: serialize orphan cleanup with shmnattch updates shmdestroyorphaned walks the shm idr und...

Linux core/ufshcd.c DoS

The vulnerability in the core/ufshcd.c component of the Linux kernel system is related to concurrent execution using shared resources with improper synchronization. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

SUSE CVE-2026-74451

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...