11871 matches found
CVE-2026-16037: Observable Timing Discrepancy
Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...
ALSA-2026:64815 Moderate: pam security update
Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...
Moderate: pam security update
Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...
Fedora 44 : perl-Net-OAuth (2026-e33554bf9f)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e33554bf9f advisory. Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non- constant-time comparison in verify. This update...
RHEL 9 : pam (RHSA-2026:64815)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64815 advisory. Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle...
Fedora 43 : perl-Net-OAuth (2026-370bd8b5f0)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-370bd8b5f0 advisory. Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non- constant-time comparison in verify. This update...
Efficient Hardware Information-Flow Tracking for Pre-Silicon Security Testing
Register-Transfer Level RTL simulation is widely used to test hardware before it is fabricated. To allow testing for security related information flow properties, such as confidentiality and integrity, taint logic can be automatically added to the design to track how information flows through it...
Characterizing Contention-Induced Reliability Collapse in KV-Cache Timing Side Channels for Multi-Tenant LLM Serving
Shared key--value KV cache reuse improves large language model LLM serving, but it can also create a timing side channel that reveals whether a prefix is already cached. Previous work shows that such attacks are possible, but their reliability under realistic multi-tenant contention is less...
memcached: memcached: Username enumeration via timing side channel
A flaw was found in memcached. A remote attacker can exploit a timing side channel during Simple Authentication and Security Layer SASL password database authentication. This vulnerability allows an attacker to observe subtle timing differences, which could be used to enumerate valid usernames...
Security update for apr-util
This update for apr-util fixes the following issues: CVE-2022-25147: buffer overflow possible with specially crafted input bsc1207866. CVE-2025-49506: leaking content via side channel timing attack bsc1274237. CVE-2026-32327: XML stack recursion crash bsc1274235. CVE-2026-34191: SQL Injection via...
SUSE-SU-2026:3937-1 Security update for apr-util
This update for apr-util fixes the following issues: - CVE-2022-25147: buffer overflow possible with specially crafted input bsc1207866. - CVE-2025-49506: leaking content via side channel timing attack bsc1274237. - CVE-2026-32327: XML stack recursion crash bsc1274235. - CVE-2026-34191: SQL...
security-research — Updated!
Security Research Vulnerabilities I have reported to the Apache Software Foundation, disclosed through the ASF security process. 46 CVEs across 15 projects , 2023 to 2026. Where a public reproducer exists it is linked. Each one is a minimal, self-contained project that demonstrates the issue and...
AI-Assisted Design of a Post-Quantum Cryptographic Accelerator: A Deployed-Silicon Case Study
Post-quantum migration is mandated on published timelines, and silicon that ships with a defect cannot be patched remotely. The standard acceptance gate cannot detect an entire class of ML-DSA defects. Signing resamples until a candidate meets its norm bounds, so the executed path varies with the...
PT-2026-84941
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASoC xilinx formatter pcm component where interrupt handlers use dev get drvdata to retrieve driver data. Because the driver data is only assigned at the end of th...
Linux Distros Unpatched Vulnerability : CVE-2026-84308
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php...
GO-2026-6328 free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA in github.com/free5gc/ausf
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES in 5G-AKA in github.com/free5gc/ausf...
Updated apr-util packages fix security vulnerabilities
Apache Portable Runtime Utility: aprpasswordvalidate vulnerable to timing attack. CVE-2025-49506 Apache Portable Runtime Utility: apr-util XML stack recursion crash. CVE-2026-32327 Apache Portable Runtime Utility: SQL Injection in aprdbdoracle. CVE-2026-34191 Apache Portable Runtime Utility: Heap...
Updated perl-Net-OAuth packages fix security vulnerabilities
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smartrequire Net::OAuth versions before 0.3...
MGASA-2026-0364 Updated apr-util packages fix security vulnerabilities
Apache Portable Runtime Utility: aprpasswordvalidate vulnerable to timing attack. CVE-2025-49506 Apache Portable Runtime Utility: apr-util XML stack recursion crash. CVE-2026-32327 Apache Portable Runtime Utility: SQL Injection in aprdbdoracle. CVE-2026-34191 Apache Portable Runtime Utility: Heap...
