Monthly
Keystream reuse in the native one-shot CTR packet cipher of Bouncy Castle for Java LTS before 2.73.13 allows remote attackers to recover plaintext from ciphertext alone, without knowledge of the key. Exploitation is unauthenticated but conditional: the application must use the native one-shot CTR path with a 13-, 14-, or 15-byte IV, leaving only a 1-, 2-, or 3-byte block counter (256, 65,536, or 16,777,216 blocks), and must pass a single input longer than that counter space so the counter wraps and the keystream restarts within the packet. The call returns the full input length with no exception, so the caller receives no signal that some bytes were transformed under a repeated keystream; the resulting two-time-pad condition permits plaintext recovery. No public exploit code has been identified at time of analysis, and the non-default short-IV native deployment requirement keeps realistic exposure narrow, which is why this is assessed as AC:H rather than trivially exploitable.
AES-GCM nonce reuse in wolfEngine before 1.4.1 allows a network-positioned passive adversary to fully recover encrypted plaintext and forge authentication tags across all TLS 1.2 and DTLS 1.2 sessions. The 8-byte explicit nonce is generated once at TLS write-key setup and never incremented per record, meaning every GCM record within a connection shares an identical (key, nonce) pair - a catastrophic misuse of authenticated encryption. AES-CCM cipher suites, TLS 1.3, and non-TLS uses of AES-GCM are explicitly unaffected; no public exploit identified at time of analysis.
Nonce reuse in wolfProvider before 1.2.2 completely breaks AES-GCM confidentiality and integrity guarantees for every TLS 1.2 and DTLS 1.2 connection using that cipher suite. Because the 8-byte explicit nonce is set once at key establishment and never incremented, every record in a session is encrypted under an identical (key, nonce) pair - the classical 'forbidden attack' condition where XORing two ciphertexts yields the XOR of the plaintexts, and the GHASH authentication key can be algebraically recovered to enable tag forgery. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the attack is well-understood cryptography with no special tooling required beyond captured traffic.
AES-GCM nonce reuse in ePA3-Service-OpenSource (all versions prior to 1.3.0) allows a network-positioned attacker to recover plaintext patient health records and forge authenticated VAU protocol messages. The frozen `request_counter` in `VAUProtokoll.py` causes every outgoing message to be encrypted under the same nonce-key pair, breaking AES-GCM's fundamental security guarantee. No public exploit code is confirmed at time of analysis, but the underlying Joux forbidden attack is well-documented in cryptographic literature, and the affected data - Germany's national electronic patient records - carries exceptional regulatory and clinical sensitivity.
Sensitive key material can be exposed in Qualcomm Snapdragon platforms because AES-GCM key wrapping is performed with a hardcoded/static initialization vector instead of a unique per-call nonce. A local, low-privileged attacker who can collect multiple wrapped outputs can exploit the resulting IV/nonce reuse to recover confidentiality and forge integrity of wrapped keys. There is no public exploit identified at time of analysis, and the issue is disclosed via Qualcomm's July 2026 security bulletin.
Plaintext recovery of webflow conversation state in Apereo CAS (versions 7.3.0 up to but not including 8.0.0-RC6) lets remote unauthenticated attackers decrypt sensitive login-flow data by exploiting AES-GCM nonce reuse. Because the server encrypts client-side webflow execution tokens with a fixed all-zero initialization vector under a single long-lived key, an attacker can harvest multiple tokens from the public login page and apply known-plaintext/keystream-reuse analysis to break confidentiality (and, given GCM's nonce-reuse properties, integrity of the token). Publicly available exploit code exists; the flaw was reported by VulnCheck and carries a CVSS 4.0 base of 9.3, though no CISA KEV listing or EPSS score is provided.
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to access database backup and restore functionality exposed by dbbak.php. The flaw stems from a shared cryptographic key (CWE-323) between UCenter integration and the backup API, which lets an attacker abuse an encryption oracle in logging_ctl::logging_more() to mint legitimately signed authorization tokens, and chain a race condition to impersonate arbitrary users. Publicly available exploit code exists and an upstream fix has been published on Gitee.
Private-key recovery is possible in Crypt::DSA for Perl (all versions before 1.21) because the module caches the per-signature DSA nonce (k) inside the Key object and never clears it, causing every call to sign() after the first to reuse the identical nonce and produce signatures with matching r values. Any attacker who can observe two or more DSA signatures produced by the same Key object can apply well-known algebraic techniques to recover the private key entirely, after which they can forge arbitrary signatures. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the cryptographic impact is catastrophic: all keys used to sign more than once under an affected version must be treated as fully compromised.
CVE-2026-3559 is an authentication bypass vulnerability in Philips Hue Bridge devices affecting the HomeKit Accessory Protocol implementation, where a static nonce in the SRP authentication mechanism allows network-adjacent attackers to gain unauthorized access without credentials. With a CVSS score of 8.1 and requiring only local network access, attackers can achieve high confidentiality and integrity impact on the affected smart home infrastructure. No active exploitation (not in KEV), POC availability, or EPSS data is currently available.
strongMan's credential encryption uses a static initialization vector with AES-CTR mode, causing all database fields to be encrypted with identical key streams. An attacker with database access can leverage publicly stored certificates to derive the key stream and decrypt stored private keys and EAP secrets. No patch is currently available for this high-severity vulnerability affecting strongSwan management deployments.
Keystream reuse in the native one-shot CTR packet cipher of Bouncy Castle for Java LTS before 2.73.13 allows remote attackers to recover plaintext from ciphertext alone, without knowledge of the key. Exploitation is unauthenticated but conditional: the application must use the native one-shot CTR path with a 13-, 14-, or 15-byte IV, leaving only a 1-, 2-, or 3-byte block counter (256, 65,536, or 16,777,216 blocks), and must pass a single input longer than that counter space so the counter wraps and the keystream restarts within the packet. The call returns the full input length with no exception, so the caller receives no signal that some bytes were transformed under a repeated keystream; the resulting two-time-pad condition permits plaintext recovery. No public exploit code has been identified at time of analysis, and the non-default short-IV native deployment requirement keeps realistic exposure narrow, which is why this is assessed as AC:H rather than trivially exploitable.
AES-GCM nonce reuse in wolfEngine before 1.4.1 allows a network-positioned passive adversary to fully recover encrypted plaintext and forge authentication tags across all TLS 1.2 and DTLS 1.2 sessions. The 8-byte explicit nonce is generated once at TLS write-key setup and never incremented per record, meaning every GCM record within a connection shares an identical (key, nonce) pair - a catastrophic misuse of authenticated encryption. AES-CCM cipher suites, TLS 1.3, and non-TLS uses of AES-GCM are explicitly unaffected; no public exploit identified at time of analysis.
Nonce reuse in wolfProvider before 1.2.2 completely breaks AES-GCM confidentiality and integrity guarantees for every TLS 1.2 and DTLS 1.2 connection using that cipher suite. Because the 8-byte explicit nonce is set once at key establishment and never incremented, every record in a session is encrypted under an identical (key, nonce) pair - the classical 'forbidden attack' condition where XORing two ciphertexts yields the XOR of the plaintexts, and the GHASH authentication key can be algebraically recovered to enable tag forgery. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the attack is well-understood cryptography with no special tooling required beyond captured traffic.
AES-GCM nonce reuse in ePA3-Service-OpenSource (all versions prior to 1.3.0) allows a network-positioned attacker to recover plaintext patient health records and forge authenticated VAU protocol messages. The frozen `request_counter` in `VAUProtokoll.py` causes every outgoing message to be encrypted under the same nonce-key pair, breaking AES-GCM's fundamental security guarantee. No public exploit code is confirmed at time of analysis, but the underlying Joux forbidden attack is well-documented in cryptographic literature, and the affected data - Germany's national electronic patient records - carries exceptional regulatory and clinical sensitivity.
Sensitive key material can be exposed in Qualcomm Snapdragon platforms because AES-GCM key wrapping is performed with a hardcoded/static initialization vector instead of a unique per-call nonce. A local, low-privileged attacker who can collect multiple wrapped outputs can exploit the resulting IV/nonce reuse to recover confidentiality and forge integrity of wrapped keys. There is no public exploit identified at time of analysis, and the issue is disclosed via Qualcomm's July 2026 security bulletin.
Plaintext recovery of webflow conversation state in Apereo CAS (versions 7.3.0 up to but not including 8.0.0-RC6) lets remote unauthenticated attackers decrypt sensitive login-flow data by exploiting AES-GCM nonce reuse. Because the server encrypts client-side webflow execution tokens with a fixed all-zero initialization vector under a single long-lived key, an attacker can harvest multiple tokens from the public login page and apply known-plaintext/keystream-reuse analysis to break confidentiality (and, given GCM's nonce-reuse properties, integrity of the token). Publicly available exploit code exists; the flaw was reported by VulnCheck and carries a CVSS 4.0 base of 9.3, though no CISA KEV listing or EPSS score is provided.
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to access database backup and restore functionality exposed by dbbak.php. The flaw stems from a shared cryptographic key (CWE-323) between UCenter integration and the backup API, which lets an attacker abuse an encryption oracle in logging_ctl::logging_more() to mint legitimately signed authorization tokens, and chain a race condition to impersonate arbitrary users. Publicly available exploit code exists and an upstream fix has been published on Gitee.
Private-key recovery is possible in Crypt::DSA for Perl (all versions before 1.21) because the module caches the per-signature DSA nonce (k) inside the Key object and never clears it, causing every call to sign() after the first to reuse the identical nonce and produce signatures with matching r values. Any attacker who can observe two or more DSA signatures produced by the same Key object can apply well-known algebraic techniques to recover the private key entirely, after which they can forge arbitrary signatures. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the cryptographic impact is catastrophic: all keys used to sign more than once under an affected version must be treated as fully compromised.
CVE-2026-3559 is an authentication bypass vulnerability in Philips Hue Bridge devices affecting the HomeKit Accessory Protocol implementation, where a static nonce in the SRP authentication mechanism allows network-adjacent attackers to gain unauthorized access without credentials. With a CVSS score of 8.1 and requiring only local network access, attackers can achieve high confidentiality and integrity impact on the affected smart home infrastructure. No active exploitation (not in KEV), POC availability, or EPSS data is currently available.
strongMan's credential encryption uses a static initialization vector with AES-CTR mode, causing all database fields to be encrypted with identical key streams. An attacker with database access can leverage publicly stored certificates to derive the key stream and decrypt stored private keys and EAP secrets. No patch is currently available for this high-severity vulnerability affecting strongSwan management deployments.