Windows Win32k Elevation of Privilege Vulnerability

Windows Active Directory Federation Services Denial of Service Vulnerability

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption

concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl

SSH SFTP server denial of service via extended channel data infinite loop

wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag

Prefix-substitution forgery via integer overflow in wolfCrypt CMAC

jq: potential integer overflow in jvp_string_append

wc_VerifyEccsiHash missing sanity check

Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3

scanf %mc off-by-one heap buffer overflow

1-2 Byte Buffer Overflow in wolfSSL_X509_notAfter/notBefore

Heap buffer overflow in CertFromX509() via AuthorityKeyIdentifier

DNS Cookie bypass when combined with proxy-protocol use

wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr