RUSTSEC-2026-0239 Streaming AEAD does not authenticate stream structure

In all published versions of dcrypt-symmetric before 2.0.0, version-1 GCM and ChaCha20-Poly1305 streams used unauthenticated terminator, counter, and length fields. Decryptors trusted transmitted counters, allocated from unbounded lengths, and discarded plaintext that did not fit a caller's singl...

RUSTSEC-2026-0237 `nostr-relay-builder` is unmaintained

The nostr-relay-builder crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

PT-2026-64106

Impact The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer...

AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

SummaryAWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

EUVD-2022-2588

Malicious code in bioql PyPI...

CVE-2025-46332

Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags...

CVE-2024-45394

Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVPBytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the...

Security Bulletin: IBM Integration Bus is vulnerable to a local attacker due to Apache Jena (CVE-2023-32200)

Summary First time Integration node startup, following version to version migration, is vulnerable to allowing a local attacker to execute arbitrary code due Apache Jena in IBM Integration Bus. CVE-2023-32200 Vulnerability Details CVEID: CVE-2023-32200 DESCRIPTION: Apache Jena could allow a remot...

UBUNTU-CVE-2019-0231

Handling of the closenotify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This...

SUSE-SU-2015:1091-1 Security update for postgresql91

This update provides PostgreSQL 9.1.18, which brings fixes for security issues and other enhancements. The following vulnerabilities have been fixed: CVE-2015-3165: Avoid possible crash when client disconnects. bsc931972 CVE-2015-3166: Consistently check for failure of the printf. bsc931973...