Astra Linux – Vulnerability in wpa

Implementations of EAP-pwd in hostapd before version 2.10 and wpasupplicant before version 2.10 are vulnerable to side-channel attacks due to cache access patterns. NOTE: This issue exists because of an incomplete fix for CVE-2019-9495...

Astra Linux – Vulnerability in mbedtls

A issue was discovered in Arm Mbed TLS before version 2.23.0. A side channel allows the recovery of an ECC private key, which is related to functions such as mbedtlsecpcheckpubpriv, mbedtlspkparsekey, mbedtlspkparsekeyfile, mbedtlsecpmul, and mbedtlsecpmulrestartable...

Astra Linux – Vulnerability in mbedtls

The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS from 2.19.1 onwards does not reduce the blinded scalar before computing the inverse. This allows a local attacker to recover the private key through side-channel attacks...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in navigation and loading processes in Google Chrome prior to version 139.0.7258.66 allowed a remote attacker to bypass site isolation through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Leakage of side-channel information in DevTools in Google Chrome prior to version 94.0.4606.54 allowed a remote attacker to bypass site isolation through a crafted HTML page...

Astra Linux – Vulnerability in nss

During RSA key generation, bignum implementations used a variant of the Binary Extended Euclidean Algorithm, which involved significant input-dependent processes. This allowed attackers to perform electromagnetic-based side-channel attacks to capture traces that could lead to the recovery of secr...

Astra Linux – Vulnerability in mbedtls

A vulnerability was discovered in Arm Mbed TLS prior to version 2.24.0. An attacker can obtain a private key for RSA or static Diffie-Hellman through a side-channel attack targeting the generation of base blinding/unblinding values...

Astra Linux – Vulnerability in Linux

A issue was discovered in the Linux kernel through version 5.11.x. The kernel/bpf/verifier.c file contains unwanted out-of-bounds speculation during pointer arithmetic operations, which allows for side-channel attacks that circumvent Spectre mitigations and extract sensitive information from kern...

Astra Linux – Vulnerability in wpa

Implementations of SAE in hostapd before version 2.10, and wpasupplicant before version 2.10, are vulnerable to side-channel attacks due to cache access patterns. NOTE: This issue exists due to an incomplete fix for CVE-2019-9494...

Jump-over-ASLR-BTB

Branch-Prädiktoren & ASLR Autor: Byte Reaper Beschreibung Dieses Repository enthält eine C-Implementierung für Forschungszwecke, die Konzepte im Zusammenhang mit Branch-Prädiktoren, spekulativer Ausführung und Cache-basierten Seitenkanälen im Kontext der Address-Space-Layout-Randomization ASLR...

mojo-v

Mojo-V: Calcolo Segreto per RISC-V Mojo-V pronunciato “mojo-five” è una nuova estensione RISC-V che introduce capacità di programmazione orientate alla privacy per RISC-V. Mojo-V implementa il calcolo segreto, consentendo un'esecuzione sicura, efficiente e data-oblivious senza affidarsi a softwar...

TID-The-Instant-Destroyer

TID — The Instant Destroyer Ricerca di sicurezza indipendente nel campo della protezione dagli attacchi side-channel basati sulla cache. Panoramica TID è un protocollo specializzato progettato per eliminare i residui di dati sensibili come le chiavi crittografiche dai livelli di cache della CPU...

Vulnerabilities of the functions tcp_inbound_md5_hash(), tcp_v4_send_reset(), and tcp_v6_send_reset() in the Linux operating system, which allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of the functions tcpinboundmd5hash, tcpv4sendreset, and tcpv6sendreset in the Linux operating system are related to the disclosure of information due to the observed difference in execution time. Exploiting these vulnerabilities can allow a remote attacker to compromise the...

CVE-2026-74961

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Side-channel in the Web Audio component...

CVE-2026-74954

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure due to side-channel in the Storage: Cache API component...

SUSE CVE-2026-74954

Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102028)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102028 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SOATTACHFILTER to priv users This patch restricts the use of SOATTACHFILTER cBPF on...

CVE-2026-75589

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

UBUNTU-CVE-2026-75589

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

CVE-2026-44255 Wazuh: Username Enumeration via Timing Side-Channel

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.checkuser in framework/wazuh/rbac/orm.py performs checkpasswordhash only when the supplied username exists. A nonexistent username returns...