PT-2026-109017

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

CVE-2026-18747: Out-of-bounds Read

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

Important: perl-Net-DNS

Issue Overview: Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sigdata when re-encoding a message with a misplaced TSIG record. sigdata signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the...

UBUNTU-CVE-2026-77696

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

Linux Distros Unpatched Vulnerability : CVE-2026-54875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms...

Linux Distros Unpatched Vulnerability : CVE-2026-77696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to...

Fedora 44 : vlc (2026-ad90eab763)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ad90eab763 advisory. VLC 3.0.24: https://code.videolan.org/videolan/vlc/-/tags/3.0.24 Switch GUI to Qt6 Re-enable AS-DCP plugin Disable RDP plugin Disable Real RTSP plug...

Linux Distros Unpatched Vulnerability : CVE-2026-72897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A TLS server that calls SSLsetSSLCTX to switch a connection to a different SSLCTX part way through a handshake may access memory beyond the end o...

PT-2026-109029

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

PT-2026-109038

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

CVE-2026-77696: Observable Timing Discrepancy

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

CVE-2026-77696: Observable Timing Discrepancy

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

PT-2026-109009

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

PT-2026-109046

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

PT-2026-109082

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

PT-2026-109098

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

PT-2026-109021

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

CVE-2026-96274: Uncaught Exception

In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdo...

PT-2026-102444

Name of the Vulnerable Software and Affected Versions pbkdf2 versions prior to 3.1.7 Description The JavaScript fallback in lib/sync.js re-hashes passwords that exceed the digest's block size 64 bytes, or 128 bytes for sha384 and sha512 during every iteration. This occurs because the password is...

PT-2026-102609

Name of the Vulnerable Software and Affected Versions lib0 versions 0.2.1 through 0.2.117 lib0 versions prior to 1.0.0-rc.33 Description A missing bounds check in the binary decoder allows an unauthenticated remote peer to read adjacent process memory. The readUint8Array function fails to compare...