CVE-2026-5218

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting XSS. This issue affects E-Commerce Pack: before 5.03.01.49...

CVE-2026-42931

A flaw was found in Gitea. An authenticated attacker can trigger a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The server attempts to read the entire request body into memory without a size limit, leading to an Out-of-Memory OOM error and crashing the...

CVE-2026-12817

A flaw was found in Bouncy Castle for Java. This vulnerability affects the OpenPGP Authenticated Encryption with Associated Data AEAD decryption process. Specifically, the system fails to verify the final authentication tag when processing data that is aligned in chunks. This oversight could allo...

CVE-2026-12802

A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to compromise the integrity of data during the decryption of Cryptographic Message Syntax CMS AuthEnvelopedData. The software fails to properly enforce the tag-length, which could enable an attacker to...

Plaintext Exposure

Bouncy Castle for Java is vulnerable to plaintext exposure. The vulnerability is due to CCM-family modes writing decrypted plaintext to the caller-provided buffer before verifying the authentication tag, which allows an attacker to exploit unauthenticated or tampered ciphertext to access plaintex...

CVE-2026-74737

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted usi...

UBUNTU-CVE-2026-74737

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted usi...

CVE-2026-74737 net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted usi...

Improper Tag-Length Validation

Bouncy Castle for Java is vulnerable to improper tag-length validation. The vulnerability is due to the failure to enforce the required authentication tag length during decryption, which allows an attacker to provide a malformed or truncated authentication tag and potentially bypass the intended...

PT-2026-82117

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the packet reception path where the MAC Port ID is extracted from the RX DMA Descriptor metadata. The helper function cppi5 desc get tags ids incorrectly assigns a...

PT-2026-82361

Summary An HTML Injection vulnerability exists in the user group creation functionality that allows an attacker to inject arbitrary HTML content into the application interface. The vulnerability occurs when user-supplied input in the group name field is not properly sanitized before being rendere...

openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

A flaw was found in OpenSSL. The implementations of AES-SIV Advanced Encryption Standard - SIV and AES-GCM-SIV Advanced Encryption Standard - Galois/Counter Mode - SIV incorrectly process authentication tags for empty messages. This vulnerability allows a remote attacker to forge empty messages...

openssl: AES-OCB IV Ignored on EVP_Cipher() Path

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface EVPCipher will have their provided Initialization Vector IV silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the...

CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

AZL-97671 CVE-2026-75803 affecting package openssl-fips-provider 3.1.2-2

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

AZL-97884 CVE-2026-75803 affecting package edk2 for versions less than 20240524git3e722403cd16-20

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

AZL-97935 CVE-2026-75803 affecting package openssl for versions less than 3.3.7-6

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

ALPINE-CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

CVE-2026-75803 AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...