11879 matches found
CVE-2026-21840
HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...
CVE-2026-21840 HCL BigFix Platform is affected by a user enumeration vulnerability
HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...
CVE-2026-21840 HCL BigFix Platform is affected by a user enumeration vulnerability
HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...
Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView
Summary IBM SPSS Modeler is affected by multiple vulnerabilities in DataView. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA...
tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses...
fastify-static-zero-days
@fastify/static — Multiple Zero-Day Vulnerabilities Package...
tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses...
Security Bulletin: Vulnerability affect cryptography-46.0.5, and bcprov-jdk18on-1.82.jar IBM COS Systems (July 2026)
Summary Vulnerability with cryptography-46.0.5 CVE-2026-39892, and bcprov-jdk18on-1.82.jar CVE-2025-14813, CVE-2026-5598 . This vulnerability has been addressed in the latest ClevOS release. Vulnerability Details CVEID:CVE-2026-39892 DESCRIPTION: cryptography is a package designed to expose...
RUSTSEC-2026-0211 Non-constant time Authentication Tag Check in AES-GCM Decryption
AES-GCM decryption used an implementation for checking the provided authentication tag against the recomputed authentication tag that was intended to be constant-time, but resulted in non-constant-time code generation in certain circumstances. Note that libcrux-aesgcm does not give guarantees on...
Non-constant time Authentication Tag Check in AES-GCM Decryption
AES-GCM decryption used an implementation for checking the provided authentication tag against the recomputed authentication tag that was intended to be constant-time, but resulted in non-constant-time code generation in certain circumstances. Note that libcrux-aesgcm does not give guarantees on...
PT-2026-64466
wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted muldi3 subroutine executes in variable time based on operand values. This affects multiple SP math functions sp 256 mul 9, sp 256 sqr 9, etc., leading to a...
PT-2026-58852
HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...
PT-2026-64467
In wolfSSL 5.8.4, constant-time masking logic in sp 256 get entry 256 9 is optimized into conditional branches bnez by GCC when targeting RISC-V RV32I with -O3. This transformation breaks the side-channel resistance of ECC scalar multiplication, potentially allowing a local attacker to recover...
CVE-2026-21840: Observable Timing Discrepancy
HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...
PT-2026-64399
AES-GCM decryption used an implementation for checking the provided authentication tag against the recomputed authentication tag that was intended to be constant-time, but resulted in non-constant-time code generation in certain circumstances. Note that libcrux-aesgcm does not give guarantees on...
PYSEC-2026-3028 pyquorum: Timing side‑channel in mul_mod
Impact The mulmod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand the exponent. An attacker who can measure the time of secret‑sharing operations e.g., via a remote service could progressively recover the valu...
pyquorum: Timing side‑channel in mul_mod
ImpactThe mulmod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand the exponent. An attacker who can measure the time of secret‑sharing operations e.g., via a remote service could progressively recover the value...
OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function
An issue in OpenFUN Richie LMS in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the synccourserunfromrequest function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response...
PYSEC-2026-3052 OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function
An issue in OpenFUN Richie LMS in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the synccourserunfromrequest function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response...