https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T15:15:23.102354+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-22791 CVE-2026-22791 — openCryptoki incorrectly calculates the buffer size in C_WrapKey with CKM_ECDH_AES_KEY_WRAP 2026-10-01T15:15:24.950221+00:00

Affected: opencryptoki

openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.

 https://vulnerability.circl.lu/vuln/usn-8707-1 USN-8707-1 — opencryptoki vulnerabilities 2026-10-01T15:15:24.950356+00:00

Affected: Ubuntu:26.04:LTS: opencryptoki

It was discovered that primitive decoders in openCryptoki produced integer underflows when the encoded length was zero. An attacker could possibly use this issue to trigger out-of-bounds reads. (CVE-2026-40253)

It was discovered that openCryptoki incorrectly handled symlinks. An attacker in the token-group could possibly use this issue to achieve privilege escalation or access sensitive information. (CVE-2026-23893)

It was discovered that the CKM_ECDH_AES_KEY_WRAP implementation had a heap buffer overflow vulnerability. An attacker could possibly use this issue to trigger heap corruption, or denial-of-service. (CVE-2026-22791)