Every CVE of the last six months, updated daily.

Showing 6 of 6

• MediumCVE-2026-84308CVSS score 6.3Sep 1, 2026

  phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery la

  CWE-208CWE-385
• LowCVE-2026-55785CVSS score 3.7Aug 28, 2026

  free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedur

  CWE-208CWE-385CWE-532
• MediumCVE-2026-6478CVSS score 6.5May 14, 2026

  Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, cur

  CWE-385postgresql postgresql
• HighCVE-2026-5598CVSS score 7.5Apr 15, 2026

  Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from

  CWE-385
• MediumCVE-2025-69893CVSS score 4.6Apr 14, 2026

  A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to v1.14.0, and Trezor Safe v1.13.0 to v1.14.0 hardware wallets. This originates from the BIP-39 standard gu

  CWE-385
• MediumCVE-2025-66442CVSS score 5.1Apr 1, 2026

  In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

  CWE-385arm mbed_tlsarm tf-psa-crypto