https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:22:58 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-02383 bdu:2026-02383 https://cve.radiocsirt.org/vuln/bdu:2026-02383 https://cve.radiocsirt.org/vuln/bell-cve-2025-69277 <p><strong>Affected:</strong> Alpaquita:23: libsodium, Alpaquita:25: libsodium, Alpaquita:stream: libsodium</p> <p><strong>Affected:</strong> Alpaquita:23: libsodium, Alpaquita:25: libsodium, Alpaquita:stream: libsodium</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-69277 https://cve.radiocsirt.org/vuln/brew-ansible-cve-2025-69277 <p><strong>Affected:</strong> Homebrew: ansible</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&#39;t in the main cryptographic group.</p> <p>This advisoory lists packages in the GitHub Advisory Database&#39;s [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.</p> <p><strong>Affected:</strong> Homebrew: ansible</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&#39;t in the main cryptographic group.</p> <p>This advisoory lists packages in the GitHub Advisory Database&#39;s [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.</p> https://cve.radiocsirt.org/vuln/brew-ansible-cve-2025-69277 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0209 certfr-2026-avi-0209 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0209 https://cve.radiocsirt.org/vuln/cleanstart-2026-ks43633 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Package airflow-3 version 3.0.6-r1 fixes 29 vulnerabilities: CVE-2026-25604, CVE-2026-42526, CVE-2026-27173, CVE-2026-41018, CVE-2026-46745...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Package airflow-3 version 3.0.6-r1 fixes 29 vulnerabilities: CVE-2026-25604, CVE-2026-42526, CVE-2026-27173, CVE-2026-41018, CVE-2026-46745...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ks43633 https://cve.radiocsirt.org/vuln/euvd-2026-265082 EUVD-2026-265082 https://cve.radiocsirt.org/vuln/euvd-2026-265082 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69277 <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&#39;t in the main cryptographic group.</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&#39;t in the main cryptographic group.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-69277 https://cve.radiocsirt.org/vuln/ghsa-mrfv-m5wm-5w6w <p><strong>Affected:</strong> Packagist: paragonie/sodium_compat, PyPI: PyNaCl, PyPI: hdwallet</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&#39;t in the main cryptographic group.</p> <p>This advisoory lists packages in the GitHub Advisory Database&#39;s [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.</p> <p><strong>Affected:</strong> Packagist: paragonie/sodium_compat, PyPI: PyNaCl, PyPI: hdwallet</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&#39;t in the main cryptographic group.</p> <p>This advisoory lists packages in the GitHub Advisory Database&#39;s [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.</p> https://cve.radiocsirt.org/vuln/ghsa-mrfv-m5wm-5w6w https://cve.radiocsirt.org/vuln/icsa-26-071-03 <p>An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters. An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing. An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key. Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP…</p> <p>An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters. An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing. An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key. Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP…</p> https://cve.radiocsirt.org/vuln/icsa-26-071-03 https://cve.radiocsirt.org/vuln/msrc_cve-2025-69277 msrc_CVE-2025-69277 https://cve.radiocsirt.org/vuln/msrc_cve-2025-69277 https://cve.radiocsirt.org/vuln/ncsc-2026-0079 NCSC-2026-0079 https://cve.radiocsirt.org/vuln/ncsc-2026-0079 https://cve.radiocsirt.org/vuln/oesa-2026-1097 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: libsodium</p> <p>Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further. Security Fix(es):</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&amp;apos;t in the main cryptographic group.(CVE-2025-69277)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: libsodium</p> <p>Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further. Security Fix(es):</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&amp;apos;t in the main cryptographic group.(CVE-2025-69277)</p> https://cve.radiocsirt.org/vuln/oesa-2026-1097 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10130-1 <p>python311-PyNaCl-1.6.2-1.1 on GA media</p> <p>python311-PyNaCl-1.6.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10130-1 https://cve.radiocsirt.org/vuln/pysec-2026-1448 <p><strong>Affected:</strong> PyPI: hdwallet</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&#39;t in the main cryptographic group.</p> <p>This advisoory lists packages in the GitHub Advisory Database&#39;s [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.</p> <p><strong>Affected:</strong> PyPI: hdwallet</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&#39;t in the main cryptographic group.</p> <p>This advisoory lists packages in the GitHub Advisory Database&#39;s [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1448 https://cve.radiocsirt.org/vuln/rhsa-2026:7369 <p>libsodium: pynacl: libsodium: Improper validation of elliptic curve points could lead to data integrity or information disclosure.</p> <p>libsodium: pynacl: libsodium: Improper validation of elliptic curve points could lead to data integrity or information disclosure.</p> https://cve.radiocsirt.org/vuln/rhsa-2026:7369 https://cve.radiocsirt.org/vuln/ssa-485750 <p>An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters. An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing. An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key. Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP…</p> <p>An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters. An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing. An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key. Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP…</p> https://cve.radiocsirt.org/vuln/ssa-485750 https://cve.radiocsirt.org/vuln/suse-su-2026:0482-1 <p>Security update for libsodium</p> <p>Security update for libsodium</p> https://cve.radiocsirt.org/vuln/suse-su-2026:0482-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-69277 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libsodium, Ubuntu:18.04:LTS: libsodium, Ubuntu:20.04:LTS: libsodium, Ubuntu:22.04:LTS: libsodium, Ubuntu:24.04:LTS: libsodium, Ubuntu:25.10: libsodium</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&#39;t in the main cryptographic group.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libsodium, Ubuntu:18.04:LTS: libsodium, Ubuntu:20.04:LTS: libsodium, Ubuntu:22.04:LTS: libsodium, Ubuntu:24.04:LTS: libsodium, Ubuntu:25.10: libsodium</p> <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren&#39;t in the main cryptographic group.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-69277 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1267 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Hardened Images RPMs ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Rechte zu erweitern, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Hardened Images RPMs ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Rechte zu erweitern, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1267