Most recent entries from all

BELL-CVE-2026-39892

Affected: Alpaquita:stream: py3-cryptography

BREW-ansible@10-CVE-2026-39892 — Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

Affected: Homebrew: ansible@10

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. `Hash.update()`), this could lead to buffer overflows. For example:

```python h = Hash(SHA256()) b.update(buf[::-1]) ```

would read past the end of the buffer on Python >3.11

certfr-2026-avi-0550 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0550

Withdrawn: CLEANSTART-2026-BY15343 — Security fixes for CVE-2026-27448, CVE-2026-27459, CVE-2026-39892, CVE-2026-44431, CVE-2026-44432, CVE-2026-4539, CVE-2…

Withdrawn by the publisher.

Affected: CleanStart: az

Multiple security vulnerabilities affect the az package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-366071

fkie_cve-2026-39892

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

GHSA-p423-j2cm-9vmq — Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

Affected: PyPI: cryptography

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. `Hash.update()`), this could lead to buffer overflows. For example:

```python h = Hash(SHA256()) b.update(buf[::-1]) ```

would read past the end of the buffer on Python >3.11

NCSC-2026-0256 — Kwetsbaarheden verholpen in Oracle Communications

NCSC-2026-0256

openSUSE-SU-2026:10535-1 — python311-cryptography-46.0.7-1.1 on GA media

python311-cryptography-46.0.7-1.1 on GA media

PYSEC-2026-36

Affected: PyPI: cryptography

RHSA-2026:19375 — Red Hat Security Advisory: Red Hat Quay 3.16.4

golang: net/url: Memory exhaustion in query parameter parsing in net/url axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 pyOpenSSL: DTLS cookie callback buffer overflow authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution svgo: SVGO: Denial of Service via XML entity expansion pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root github.com/jackc/pgproto3/v2: github.com/jackc/p…

WID-SEC-W-2026-1434 — IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Cross-Site-Scripting-Angriffe durchzuführen.