CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 10:40 UTC)

What this means for you

This week: 5,488 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,488; Show in the list
Critical, last 7 days: 358; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product legion_of_the_bouncy_castle:bc_fja. Show all products

30 CVEs, showing 1 to 30

CVE	Severity	Title	Published
CVE-2026-15055	Medium 5.3	PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input Assigned by bcorg	Aug 3, 2026
CVE-2026-8763	Critical 9.3	Name Constraints bypass via trailing dot in rfc822Name and URI Assigned by bcorg	Aug 3, 2026
CVE-2026-59649	High 8.7	OpenPGP user-attribute subpacket length bounded only by JVM max memory Assigned by bcorg	Aug 3, 2026
CVE-2026-59648	Medium 6.9	OpenPGP Argon2 S2K honours attacker-chosen memory and passes Assigned by bcorg	Aug 3, 2026
CVE-2026-59647	Medium 6.9	CRMF/CMP password-MAC honours unbounded iteration count Assigned by bcorg	Aug 3, 2026
CVE-2026-59646	High 8.7	DTLS handshake reassembler allocates buffer from unchecked 24-bit length Assigned by bcorg	Aug 3, 2026
CVE-2026-59645	High 8.7	OER parser recurses without depth limit on self-referential IEEE 1609.2 schema Assigned by bcorg	Aug 3, 2026
CVE-2026-59643	High 8.7	OpenPGP inline-signature policy failures silently ignored Assigned by bcorg	Aug 3, 2026
CVE-2026-59642	High 8.7	CMS AuthenticatedData content not bound to MAC when authAttrs present Assigned by bcorg	Aug 3, 2026
CVE-2026-59641	High 8.7	S/MIME validator trusts signer-asserted signingTime for path validation Assigned by bcorg	Aug 3, 2026
CVE-2026-59640	High 8.7	OpenPGP CFB quick-check oracle active on symmetric/session-key paths Assigned by bcorg	Aug 3, 2026
CVE-2026-59639	High 8.7	CMS verifySignatures returns true for SignedData with zero signers Assigned by bcorg	Aug 3, 2026
CVE-2026-59638	Critical 9.3	JSSE hostname verifier CN-fallback enabled by default despite documented opt-in Assigned by bcorg	Aug 3, 2026
CVE-2026-58063	Medium 5.3	BCFKS keystore load honours unbounded KDF cost from untrusted file Assigned by bcorg	Aug 3, 2026
CVE-2026-58062	Critical 9.3	Stapled OCSP response accepted without binding to the checked certificate Assigned by bcorg	Aug 3, 2026
CVE-2026-58061	High 8.7	CCM-family modes write plaintext to caller buffer before tag check Assigned by bcorg	Aug 3, 2026
CVE-2026-58060	High 8.7	HSS public-key level count unbounded, enabling huge allocation on verify Assigned by bcorg	Aug 3, 2026
CVE-2026-58059	High 8.7	Quadratic-time escaping when stringifying X.500 distinguished names Assigned by bcorg	Aug 3, 2026
CVE-2026-14682	High 8.7	Possible OOM from unbounded up-front allocation on a definite-length read Assigned by bcorg	Aug 3, 2026
CVE-2026-12802	High 8.7	CMS AuthEnvelopedData fails to enforce tag-length on decryption Assigned by bcorg	Aug 3, 2026
CVE-2026-12817	High 8.7	OpenPGP AEAD decryption skips final tag on chunk-aligned data Assigned by bcorg	Aug 3, 2026
CVE-2026-13506	High 8.7	Lazy ASN.1 sequence forcing resets nesting-depth guard Assigned by bcorg	Aug 3, 2026
CVE-2026-13586	Medium 5.3	PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) Assigned by bcorg	Aug 3, 2026
CVE-2026-8798	High 8.7	Native entropy source retries the CPU entropy instructions without limit Assigned by bcorg	Aug 8, 2026
CVE-2026-13505	High 8.7	Zeroisation of sensitive key material on garbage collection relies on finalization Assigned by bcorg	Aug 8, 2026
CVE-2026-17508	Medium 5.3	Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points Assigned by bcorg	Oct 2, 2026
CVE-2026-85515	High 8.2	OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check Assigned by bcorg	Oct 3, 2026
CVE-2026-71892	Medium 6.9	CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys Assigned by bcorg	Oct 3, 2026
CVE-2026-71889	High 8.7	PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate Assigned by bcorg	Oct 3, 2026
CVE-2026-71888	High 8.7	CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent Assigned by bcorg	Oct 3, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.