Month: July 2026

Information published. Continue reading CVE-2026-57062 CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.→

Information published. Continue reading CVE-2026-13595 Util-linux: util-linux: heap use-after-free in libblkid nested partition probing→

Information published. Continue reading CVE-2026-11625 Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes→

Information published. Continue reading CVE-2026-7531 Use-after-free in PQC hybrid key-share handling→

Information published. Continue reading CVE-2026-6412 Continued acceptance of SHA-1/MD5 digests in certificate processing→

Information published. Continue reading CVE-2026-6092 Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configured→

Information published. Continue reading CVE-2026-11310 X.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchoring→

Information published. Continue reading CVE-2026-10097 ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery→