https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T11:41:17.033963+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-266327 EUVD-2026-266327 2026-10-05T11:41:17.089946+00:00 EUVD-2026-266327 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23966 fkie_cve-2026-23966 2026-10-05T11:41:17.089982+00:00

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.

 https://cve.radiocsirt.org/vuln/ghsa-pgx9-497m-6c4v GHSA-pgx9-497m-6c4v — sm-crypto Affected by Private Key Recovery in SM2-PKE 2026-10-05T11:41:17.090015+00:00

Affected: npm: sm-crypto

### Summary

A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions.

### Credit

This vulnerability was discovered by: - XlabAI Team of Tencent Xuanwu Lab - Atuin Automated Vulnerability Discovery Engine