CVE-2026-71889

Bouncy Castle for Java contains a vulnerability where the PKIXCertPathReviewer (both org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and the legacy org.bouncycastle.x509.PKIXCertPathReviewer) fails to apply X.509 name constraints to the end-entity certificate. The root cause is that checkNameCo...

CVE-2026-71889 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71889 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71889 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

EUVD-2026-91989

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

CVE-2026-71892

Bouncy Castle for Java versions before 1.86 contain a flaw where opt-in key-size validation on CMS key-transport recipients fails for messages using RFC 9709 content-encryption key derivation (id-alg-cek-hkdf-sha256 ). The root cause is an incorrect comparison between a byte array and an ASN1Obje...

CVE-2026-71892 CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

CVE-2026-71892 CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

CVE-2026-71892 CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

[SECURITY] Fedora 45 Update: libxml2_2.13-2.13.9-4.fc45

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

PT-2026-104584

Name of the Vulnerable Software and Affected Versions Themeum Kirki versions prior to 6.3.1 Description Improper validation of the specified quantity in input allows access to functionality not properly constrained by Access Control Lists ACLs, which are security mechanisms that define which user...

CVE-2026-87115: Improper Limitation of a Pathname to a Restricted Directory

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...

CVE-2026-71889: Improper Certificate Validation

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71885: Improper Certificate Validation

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

Linux Distros Unpatched Vulnerability : CVE-2026-94645

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This...

Linux Distros Unpatched Vulnerability : CVE-2026-94646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution'...

Linux Distros Unpatched Vulnerability : CVE-2026-85088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client...

Post-Quantum Authentication Protocol for Internet of Medical Things

IoMT communication systems should provide origin authentication and ensure integrity protection for the messages produced by patients' devices for transmission to gateways and further processing by other hospital services. With regard to IoMT, this paper discusses tampering, impersonation, and...

PT-2026-104560

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description The high-level OpenPGP API incorrectly accepts data signatures from a signing subkey when the Subkey Binding signature lacks an embedded Primary Key Binding cross-certification signatur...