ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session

Published 2026-10-09 by GitHub_M

enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session

Published 2026-10-09 by GitHub_M

Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Published 2026-10-09 by GitHub_M

Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Published 2026-10-09 by GitHub_M

enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session

Published 2026-10-09 by GitHub_M

Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

Published 2026-10-09 by GitHub_M

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Published 2026-10-09 by GitHub_M

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Published 2026-10-09 by GitHub_M

Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

Published 2026-10-09 by GitHub_M

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Published 2026-10-09 by GitHub_M