{"id":"EUVD-2026-22813","enisaUuid":"3301ac9b-af60-3635-b3e1-9773353b474a","description":"Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.","datePublished":"Apr 14, 2026, 11:41:47 PM","dateUpdated":"Apr 16, 2026, 2:00:55 PM","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3\nhttps://github.com/sigstore/timestamp-authority/releases/tag/v2.0.6\n","aliases":"CVE-2026-39984\nGHSA-xm5m-wgh2-rrg3\n","assigner":"GitHub_M","epss":0.1,"enisaIdProduct":[{"id":"29170723-ee07-3694-a50c-a887d941ab31","product":{"name":"timestamp-authority","vendor":{"name":"sigstore"}},"product_version":"\u003c 2.0.6"}],"enisaIdVendor":[{"id":"d137bd74-26d0-359f-bf53-ff6244ab366b","vendor":{"name":"sigstore"}}],"enisaIdVulnerability":[{"id":"1ee705aa-b101-31d7-a5e2-6db3c30feb91","vulnerability":{"id":"CVE-2026-39984","description":"Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.","datePublished":"Apr 14, 2026, 11:41:47 PM","dateUpdated":"Apr 16, 2026, 2:00:55 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3\nhttps://github.com/sigstore/timestamp-authority/releases/tag/v2.0.6\n","enisa_id":"EUVD-2026-22813\n","assigner":"GitHub_M","epss":0.1,"dataProcessed":"Oct 27, 2026, 7:13:18 AM","vulnerabilityProduct":[{"id":"0de99927-0561-3f15-972f-5cce8cef4515","product":{"name":"timestamp-authority","vendor":{"name":"sigstore"}},"product_version":"\u003c 2.0.6"}],"vulnerabilityVendor":[{"id":"d3b7b1d4-b891-3635-ab0e-70cf5406c89f","vendor":{"name":"sigstore"}}]}},{"id":"e689970c-59b1-385b-92a1-57f5bdf73425","vulnerability":{"id":"GHSA-xm5m-wgh2-rrg3","description":"Sigstore Timestamp Authority has Improper Certificate Validation in verifier","datePublished":"Apr 14, 2026, 1:01:59 AM","dateUpdated":"Apr 24, 2026, 8:43:09 PM","baseScore":0.0,"references":"https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-39984\nhttps://github.com/sigstore/timestamp-authority\nhttps://github.com/sigstore/timestamp-authority/releases/tag/v2.0.6\n","enisa_id":"EUVD-2026-22813\n","aliases":"GHSA-xm5m-wgh2-rrg3\nCVE-2026-39984\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"09b5e2a0-708f-3b89-ac06-dab83b947c19","advisory":{"id":"SUSE-SU-2026:22456-1","description":"Security update for docker","summary":"Security update for docker","datePublished":"Jun 30, 2026, 11:41:11 AM","dateUpdated":"Sep 16, 2026, 8:01:43 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22456-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202622456-1/\nhttps://lists.suse.com/pipermail/sle-security-updates/2026-July/027252.html\nhttps://bugzilla.suse.com/1262346\nhttps://bugzilla.suse.com/1265782\nhttps://bugzilla.suse.com/1266625\nhttps://bugzilla.suse.com/1267827\nhttps://www.suse.com/security/cve/CVE-2026-33814/\nhttps://www.suse.com/security/cve/CVE-2026-39821/\nhttps://www.suse.com/security/cve/CVE-2026-39984/\nhttps://www.suse.com/security/cve/CVE-2026-41567/\n","aliases":"CVE-2026-33814\nCVE-2026-39821\nCVE-2026-39984\nCVE-2026-41567\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"0e271b13-657d-3bbf-b441-ae712584f7a3","product":{"name":"SUSE Linux Micro 6.1","vendor":{"name":"SUSE"}}},{"id":"3a5a02ba-32f3-39fe-8aca-0155f526b165","product":{"name":"docker-29.4.0_ce-slfo.1.1_10.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"528f2aef-1e6f-3501-804c-d4cd01940259","product":{"name":"docker-buildx-0.33.0-slfo.1.1_10.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"606febfd-54f6-37ce-bc54-6fafbb9ebf2a","product":{"name":"docker-buildx-0.33.0-slfo.1.1_10.1.s390x","vendor":{"name":"SUSE"}}},{"id":"754fe82b-75a4-34e0-bc0b-ca88dd80a1f7","product":{"name":"docker-buildx-0.33.0-slfo.1.1_10.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"90d16057-d096-38f0-8376-c8f05296f26e","product":{"name":"docker-29.4.0_ce-slfo.1.1_10.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c1e3143c-981d-3fd0-bd91-1b26a5b81120","product":{"name":"docker-29.4.0_ce-slfo.1.1_10.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c490ec0c-c6dd-3e30-8673-2f7c38f5e6a7","product":{"name":"docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c83c92fc-e6fb-330d-ad32-9ed3e462088f","product":{"name":"docker-29.4.0_ce-slfo.1.1_10.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"2027aa5f-6e86-339b-848c-159d5280b6e0","advisory":{"id":"openSUSE-SU-2026:10651-1","description":"trivy-0.70.0-1.1 on GA media","summary":"trivy-0.70.0-1.1 on GA media","datePublished":"Apr 28, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:02:41 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10651-1.json\nhttps://www.suse.com/security/cve/CVE-2025-69725/\nhttps://www.suse.com/security/cve/CVE-2026-25934/\nhttps://www.suse.com/security/cve/CVE-2026-33186/\nhttps://www.suse.com/security/cve/CVE-2026-33747/\nhttps://www.suse.com/security/cve/CVE-2026-33748/\nhttps://www.suse.com/security/cve/CVE-2026-34986/\nhttps://www.suse.com/security/cve/CVE-2026-39984/\n","aliases":"CVE-2025-69725\nCVE-2026-25934\nCVE-2026-33186\nCVE-2026-33747\nCVE-2026-33748\nCVE-2026-34986\nCVE-2026-39984\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"02ce108f-6c95-3516-a070-178f3d386e55","product":{"name":"trivy-0.70.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"07a6b4f9-65e2-3992-a24d-5baf52762ef3","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"16e557e2-4962-389a-8dcd-d1872c39e5a1","product":{"name":"trivy-0.70.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"228f077f-6c94-3b14-8de3-864dee206306","product":{"name":"trivy-0:0.70.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"7bd48ffc-de2e-3169-9c72-4d4d3eb8e121","product":{"name":"trivy-0:0.70.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b96902ef-796a-3afc-b8a8-f9b7812ba546","product":{"name":"trivy-0:0.70.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"cbb3d84a-4331-3c80-b89f-6c298da046e7","product":{"name":"trivy-0:0.70.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"e5addb3e-9450-3bff-85d8-7162c0ca3372","product":{"name":"trivy-0.70.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"f3e90962-855b-3e69-8b3c-1a4de8ecbe5a","product":{"name":"trivy-0.70.0-1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"41219f97-6923-3660-83a5-5db2f74db90d","advisory":{"id":"openSUSE-SU-2026:10702-1","description":"hauler-1.4.3-1.1 on GA media","summary":"hauler-1.4.3-1.1 on GA media","datePublished":"May 6, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:03:39 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10702-1.json\nhttps://www.suse.com/security/cve/CVE-2026-34986/\nhttps://www.suse.com/security/cve/CVE-2026-39984/\n","aliases":"CVE-2026-34986\nCVE-2026-39984\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0efd5e0e-ef22-3d70-aaae-714d0a3e75a3","product":{"name":"hauler-0:1.4.3-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"15cc46db-10c7-3942-b084-149ac938080d","product":{"name":"hauler-0:1.4.3-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"5d1f9d09-17cb-3a6b-b0fe-11bbab1cacec","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"9bbc279d-b93b-3a0e-92f2-6fe30a03dd3d","product":{"name":"hauler-1.4.3-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a18be4d2-d536-33d8-b290-5f2fe4739be7","product":{"name":"hauler-0:1.4.3-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a709a95b-3066-3883-94df-c2afb0b44abc","product":{"name":"hauler-1.4.3-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a890f958-a8f4-35f1-9bc0-bd3691c69c08","product":{"name":"hauler-0:1.4.3-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b82d95f8-55ef-3680-803c-1f5a44108b87","product":{"name":"hauler-1.4.3-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"fd4a5b9f-3ce3-3195-9034-001082c4fdd6","product":{"name":"hauler-1.4.3-1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"89d67f49-808e-3bbe-96fc-fa4c3c09194f","advisory":{"id":"openSUSE-SU-2026:20711-1","description":"Security update for hauler","summary":"Security update for hauler","datePublished":"May 9, 2026, 8:42:06 AM","dateUpdated":"Sep 17, 2026, 5:32:16 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20711-1.json\nhttps://bugzilla.suse.com/1262353\nhttps://bugzilla.suse.com/1262942\nhttps://www.suse.com/security/cve/CVE-2026-34986/\nhttps://www.suse.com/security/cve/CVE-2026-39984/\n","aliases":"CVE-2026-34986\nCVE-2026-39984\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"657c6659-0eb3-3899-8775-7f74ef7179af","product":{"name":"hauler-0:1.4.3-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"a4a2bd6d-6a35-3cc3-8b3a-d1c62fbaf7b2","product":{"name":"hauler-0:1.4.3-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"f0f25664-06f3-31dc-975a-6feab62024ac","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}}]}},{"id":"a272afb4-11cf-33d5-b5a5-6bfd7b90f0b6","advisory":{"id":"openSUSE-SU-2026:21060-1","description":"Security update for docker","summary":"Security update for docker","datePublished":"Jun 25, 2026, 12:44:41 PM","dateUpdated":"Sep 17, 2026, 5:35:53 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21060-1.json\nhttps://bugzilla.suse.com/1262346\nhttps://bugzilla.suse.com/1265782\nhttps://bugzilla.suse.com/1266625\nhttps://bugzilla.suse.com/1267827\nhttps://www.suse.com/security/cve/CVE-2026-33814/\nhttps://www.suse.com/security/cve/CVE-2026-39821/\nhttps://www.suse.com/security/cve/CVE-2026-39984/\nhttps://www.suse.com/security/cve/CVE-2026-41567/\n","aliases":"CVE-2026-33814\nCVE-2026-39821\nCVE-2026-39984\nCVE-2026-41567\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"038c12f8-1cda-3494-b85c-82824e910a34","product":{"name":"docker-0:29.4.0_ce-160000.7.1.s390x","vendor":{"name":"SUSE"}}},{"id":"1dcb661d-fa99-325b-b809-e294690eeefe","product":{"name":"docker-0:29.4.0_ce-160000.7.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"5fdc594f-b8e5-36d7-b213-af0c1e5cbbee","product":{"name":"docker-bash-completion-0:29.4.0_ce-160000.7.1.noarch","vendor":{"name":"SUSE"}}},{"id":"910544af-8554-3743-b45d-2dfdfb3d9b2f","product":{"name":"docker-zsh-completion-0:29.4.0_ce-160000.7.1.noarch","vendor":{"name":"SUSE"}}},{"id":"9ecdbac1-d519-36da-9d1c-0a6f941ac1e1","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"a9a21cf9-4d15-3510-98d1-ae47e032ff07","product":{"name":"docker-buildx-0:0.33.0-160000.7.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b4bc4d6a-ffa1-334d-8737-1e00cb7289df","product":{"name":"docker-buildx-0:0.33.0-160000.7.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"ba3ebc39-681b-3d52-93ab-937063ad16b3","product":{"name":"docker-rootless-extras-0:29.4.0_ce-160000.7.1.noarch","vendor":{"name":"SUSE"}}},{"id":"deee4a50-471b-36bf-845c-27d2f1d51648","product":{"name":"docker-fish-completion-0:29.4.0_ce-160000.7.1.noarch","vendor":{"name":"SUSE"}}},{"id":"e43271b6-1ee1-3863-b53e-3372f9ee82c6","product":{"name":"docker-0:29.4.0_ce-160000.7.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"e71df0a0-16a9-38f1-b16b-457671a0e510","product":{"name":"docker-buildx-0:0.33.0-160000.7.1.s390x","vendor":{"name":"SUSE"}}},{"id":"f57cd593-02fc-34c5-b29d-5983b5fc31bb","product":{"name":"docker-buildx-0:0.33.0-160000.7.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"fabf79bf-f572-3789-840e-4bb6824d2dbf","product":{"name":"docker-0:29.4.0_ce-160000.7.1.ppc64le","vendor":{"name":"SUSE"}}}]}},{"id":"aff3628e-57eb-3f5b-ae39-a330f848c811","advisory":{"id":"openSUSE-SU-2026:11144-1","description":"docker-29.4.0_ce-40.1 on GA media","summary":"docker-29.4.0_ce-40.1 on GA media","datePublished":"Jun 29, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:11:56 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11144-1.json\nhttps://www.suse.com/security/cve/CVE-2026-33814/\nhttps://www.suse.com/security/cve/CVE-2026-39821/\nhttps://www.suse.com/security/cve/CVE-2026-39984/\nhttps://www.suse.com/security/cve/CVE-2026-41567/\n","aliases":"CVE-2026-33814\nCVE-2026-39821\nCVE-2026-39984\nCVE-2026-41567\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"00d37618-d4d6-3710-99c5-93019f46af45","product":{"name":"docker-bash-completion-0:29.4.0_ce-40.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"074b90c5-61f4-3295-8667-ea71059afb13","product":{"name":"docker-zsh-completion-0:29.4.0_ce-40.1.s390x","vendor":{"name":"SUSE"}}},{"id":"3954a25f-1b7f-398a-8fdf-26b83cfd675b","product":{"name":"docker-bash-completion-0:29.4.0_ce-40.1.s390x","vendor":{"name":"SUSE"}}},{"id":"419734e5-d00f-3e9a-a8ee-de54a59de342","product":{"name":"docker-bash-completion-0:29.4.0_ce-40.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"42ad9ef5-bc6f-33a2-b0b2-26e610f92337","product":{"name":"docker-zsh-completion-0:29.4.0_ce-40.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4c49cc12-ed0a-3512-980d-58fc110fc223","product":{"name":"docker-0:29.4.0_ce-40.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4d2d2767-cdbb-3800-9b12-13ddf2ec65a3","product":{"name":"docker-rootless-extras-0:29.4.0_ce-40.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5839954f-5e1c-3d70-8d5b-bf4f48c9852e","product":{"name":"docker-bash-completion-0:29.4.0_ce-40.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"69eb6cb8-23a6-3da9-ac35-7e2abe464661","product":{"name":"docker-fish-completion-0:29.4.0_ce-40.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6ac2b533-b5e2-3f5e-8019-3e2eaacd566f","product":{"name":"docker-buildx-0:0.33.0-40.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6d8119bb-f4cc-3121-8392-9b4f67df2c0e","product":{"name":"docker-zsh-completion-0:29.4.0_ce-40.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6f9fd23d-0755-3051-b536-a23840f91d50","product":{"name":"docker-fish-completion-0:29.4.0_ce-40.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"767444da-2e5a-323a-80f8-92b7015a4706","product":{"name":"docker-rootless-extras-0:29.4.0_ce-40.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7e293700-0395-3f7a-9229-029666bafdf5","product":{"name":"docker-fish-completion-0:29.4.0_ce-40.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"8b5798fd-83c0-379d-bbf2-63c137b2b6c6","product":{"name":"docker-rootless-extras-0:29.4.0_ce-40.1.s390x","vendor":{"name":"SUSE"}}},{"id":"93a15021-dd06-314a-b604-0ea6ea867b56","product":{"name":"docker-fish-completion-0:29.4.0_ce-40.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a13d3ee2-99ee-3163-9f74-1f52d346f28c","product":{"name":"docker-zsh-completion-0:29.4.0_ce-40.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a7f2b543-052d-3bf9-b702-c7b3a02a0f72","product":{"name":"docker-0:29.4.0_ce-40.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ac294e68-cb20-3bf1-b7a3-37b53263ccbd","product":{"name":"docker-0:29.4.0_ce-40.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b1f2471c-9d1c-347b-b670-57223fb7b26c","product":{"name":"docker-buildx-0:0.33.0-40.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b29f026a-fa99-37d0-8662-45d724094812","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"bd9c9a76-3603-3842-b470-b51323a0a9c5","product":{"name":"docker-buildx-0:0.33.0-40.1.s390x","vendor":{"name":"SUSE"}}},{"id":"dbb7b57f-a602-326c-86be-e46cf41a302d","product":{"name":"docker-rootless-extras-0:29.4.0_ce-40.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e8936819-1d66-3e78-be0b-c21ec85988f2","product":{"name":"docker-0:29.4.0_ce-40.1.s390x","vendor":{"name":"SUSE"}}},{"id":"f7bede29-97b2-354b-9817-572801db69ed","product":{"name":"docker-buildx-0:0.33.0-40.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"bff0b4ea-aa4f-3651-b08d-6457d52edf6c","advisory":{"id":"WID-SEC-W-2026-3046","description":"IBM Concert: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Aug 26, 2026, 10:00:00 PM","dateUpdated":"Aug 30, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3046.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3046\n","aliases":"CVE-2019-19921\nCVE-2021-23337\nCVE-2024-3651\nCVE-2024-39338\nCVE-2024-45590\nCVE-2025-13465\nCVE-2025-15284\nCVE-2025-15599\nCVE-2025-22874\nCVE-2025-47273\nCVE-2025-47907\nCVE-2025-52881\nCVE-2025-53643\nCVE-2025-55184\nCVE-2025-58056\nCVE-2025-58188\nCVE-2025-58189\nCVE-2025-61723\nCVE-2025-61730\nCVE-2025-64649\nCVE-2025-64756\nCVE-2025-67221\nCVE-2025-68121\nCVE-2025-68146\nCVE-2026-0540\nCVE-2026-2327\nCVE-2026-23490\nCVE-2026-23897\nCVE-2026-2391\nCVE-2026-23949\nCVE-2026-24486\nCVE-2026-25528\nCVE-2026-25547\nCVE-2026-25639\nCVE-2026-25990\nCVE-2026-26007\nCVE-2026-26019\nCVE-2026-26996\nCVE-2026-27142\nCVE-2026-27212\nCVE-2026-27699\nCVE-2026-27903\nCVE-2026-27904\nCVE-2026-28684\nCVE-2026-29063\nCVE-2026-29181\nCVE-2026-2950\nCVE-2026-31808\nCVE-2026-31900\nCVE-2026-32274\nCVE-2026-32288\nCVE-2026-32597\nCVE-2026-32630\nCVE-2026-32887\nCVE-2026-32952\nCVE-2026-33186\nCVE-2026-33532\nCVE-2026-33750\nCVE-2026-33814\nCVE-2026-33816\nCVE-2026-33916\nCVE-2026-34043\nCVE-2026-34073\nCVE-2026-34077\nCVE-2026-3520\nCVE-2026-35469\nCVE-2026-35515\nCVE-2026-3627\nCVE-2026-39823\nCVE-2026-39825\nCVE-2026-39826\nCVE-2026-39892\nCVE-2026-39984\nCVE-2026-40175\nCVE-2026-40179\nCVE-2026-40181\nCVE-2026-40190\nCVE-2026-40347\nCVE-2026-41066\nCVE-2026-41182\nCVE-2026-41238\nCVE-2026-41239\nCVE-2026-41240\nCVE-2026-41305\nCVE-2026-41324\nCVE-2026-41425\nCVE-2026-41481\nCVE-2026-41488\nCVE-2026-41602\nCVE-2026-41636\nCVE-2026-42151\nCVE-2026-42154\nCVE-2026-42198\nCVE-2026-42211\nCVE-2026-42338\nCVE-2026-42342\nCVE-2026-42561\nCVE-2026-42577\nCVE-2026-43870\nCVE-2026-44405\nCVE-2026-44431\nCVE-2026-44432\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44496\nCVE-2026-44728\nCVE-2026-4539\nCVE-2026-45409\nCVE-2026-45736\nCVE-2026-46625\nCVE-2026-4800\nCVE-2026-4923\nCVE-2026-4926\nCVE-2026-7246\nCVE-2026-8723\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"76a90dbd-da59-3443-a232-e3bd24181126","product":{"name":"Concert","vendor":{"name":"IBM"}}},{"id":"cc1d243a-3c05-3835-99df-7ead0933e4bb","product":{"name":"3.0.0","vendor":{"name":"ECOVACS"}}}]}},{"id":"e07a76b8-6f94-3ef4-a691-e709a8a10e6e","advisory":{"id":"SUSE-SU-2026:22285-1","description":"Security update for docker","summary":"Security update for docker","datePublished":"Jun 25, 2026, 12:44:31 PM","dateUpdated":"Oct 15, 2026, 5:08:54 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22285-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202622285-1/\nhttps://lists.suse.com/pipermail/sle-updates/2026-June/047673.html\nhttps://bugzilla.suse.com/1262346\nhttps://bugzilla.suse.com/1265782\nhttps://bugzilla.suse.com/1266625\nhttps://bugzilla.suse.com/1267827\nhttps://www.suse.com/security/cve/CVE-2026-33814/\nhttps://www.suse.com/security/cve/CVE-2026-39821/\nhttps://www.suse.com/security/cve/CVE-2026-39984/\nhttps://www.suse.com/security/cve/CVE-2026-41567/\n","aliases":"CVE-2026-33814\nCVE-2026-39821\nCVE-2026-39984\nCVE-2026-41567\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"00bfbf59-de4e-3bdc-8aaa-5278ba2a20b3","product":{"name":"docker-29.4.0_ce-160000.7.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"0978dc9e-0466-3d07-a3db-e2bd962298f8","product":{"name":"docker-0:29.4.0_ce-160000.7.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"3e021059-2ff6-3a3f-8a1e-90bef3edfae8","product":{"name":"docker-buildx-0.33.0-160000.7.1.s390x","vendor":{"name":"SUSE"}}},{"id":"43a52678-bd97-3281-9acb-d5b4232b2eee","product":{"name":"docker-29.4.0_ce-160000.7.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"581756ab-d40d-3c49-a3c5-97363f163418","product":{"name":"docker-buildx-0.33.0-160000.7.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"5f8b0389-b60b-3f8f-be6e-89bdad99b3ab","product":{"name":"docker-buildx-0:0.33.0-160000.7.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7749536b-73f4-3b3b-8aa0-2b05b85888cb","product":{"name":"docker-29.4.0_ce-160000.7.1.s390x","vendor":{"name":"SUSE"}}},{"id":"80ca36d0-d4c1-307f-afc6-c178f2dd866b","product":{"name":"docker-29.4.0_ce-160000.7.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"821a2c68-9dc9-3c99-afe4-bfd7cae80c2c","product":{"name":"docker-buildx-0:0.33.0-160000.7.1.s390x","vendor":{"name":"SUSE"}}},{"id":"90c01e83-19ed-38ed-83fd-1f13dc355c70","product":{"name":"docker-buildx-0.33.0-160000.7.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"9b4e5448-fb65-34c6-b88c-bb6a17209459","product":{"name":"docker-buildx-0:0.33.0-160000.7.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"d13d52d4-1344-34a0-9299-797cab8e5067","product":{"name":"docker-0:29.4.0_ce-160000.7.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d6a1146a-bb82-3191-91b8-fd5f31564e5c","product":{"name":"docker-buildx-0:0.33.0-160000.7.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"dc30b8b3-4cfd-39c3-ade9-b34a5de9c396","product":{"name":"SUSE Linux Micro 6.2","vendor":{"name":"SUSE"}}},{"id":"e00909fd-9298-3a66-98bf-3985d7de6655","product":{"name":"docker-0:29.4.0_ce-160000.7.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"e04bb967-4bab-305d-9e29-3c4e9709a6ec","product":{"name":"docker-0:29.4.0_ce-160000.7.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e4670165-4c27-3665-ac39-5520700dff98","product":{"name":"docker-buildx-0.33.0-160000.7.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"e29cfea0-59eb-3036-84ad-51b3988fae88","advisory":{"id":"SUSE-SU-2026:22367-1","description":"Security update for docker","summary":"Security update for docker","datePublished":"Jun 25, 2026, 12:44:31 PM","dateUpdated":"Sep 16, 2026, 8:00:11 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22367-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202622367-1/\nhttps://lists.suse.com/pipermail/sle-updates/2026-July/047772.html\nhttps://bugzilla.suse.com/1262346\nhttps://bugzilla.suse.com/1265782\nhttps://bugzilla.suse.com/1266625\nhttps://bugzilla.suse.com/1267827\nhttps://www.suse.com/security/cve/CVE-2026-33814/\nhttps://www.suse.com/security/cve/CVE-2026-39821/\nhttps://www.suse.com/security/cve/CVE-2026-39984/\nhttps://www.suse.com/security/cve/CVE-2026-41567/\n","aliases":"CVE-2026-33814\nCVE-2026-39821\nCVE-2026-39984\nCVE-2026-41567\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"29768dcb-be4f-370a-a2ad-596dbda3c8f3","product":{"name":"docker-29.4.0_ce-160000.7.1.s390x","vendor":{"name":"SUSE"}}},{"id":"37c40b3d-cc73-3c8a-8d8b-2f5034b67a9d","product":{"name":"docker-fish-completion-29.4.0_ce-160000.7.1.noarch","vendor":{"name":"SUSE"}}},{"id":"3cf28aa0-625a-3b49-a9e1-3642c5c0307c","product":{"name":"docker-buildx-0.33.0-160000.7.1.s390x","vendor":{"name":"SUSE"}}},{"id":"47576693-0688-3600-b010-8a9e34e763ff","product":{"name":"docker-bash-completion-29.4.0_ce-160000.7.1.noarch","vendor":{"name":"SUSE"}}},{"id":"6b97f051-8cc1-370d-99a4-727e0078112f","product":{"name":"SUSE Linux Enterprise Server for SAP applications 16.0","vendor":{"name":"SUSE"}}},{"id":"6e4c5892-1ae0-3a20-b430-657ddc84f694","product":{"name":"docker-29.4.0_ce-160000.7.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"72047f3b-14d9-34b6-afff-5ba655d61d9a","product":{"name":"SUSE Linux Enterprise Server 16.0","vendor":{"name":"SUSE"}}},{"id":"b8aeb986-12a2-3268-823c-0aff66b97817","product":{"name":"docker-zsh-completion-29.4.0_ce-160000.7.1.noarch","vendor":{"name":"SUSE"}}},{"id":"c6c1a43f-1042-36ee-bfab-5643b753e261","product":{"name":"docker-buildx-0.33.0-160000.7.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"d19077bb-5c26-3fa8-b6b4-4344b51e08e8","product":{"name":"docker-29.4.0_ce-160000.7.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"dbcc61be-abe0-3da3-8be4-d5864ffd89b7","product":{"name":"docker-29.4.0_ce-160000.7.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"e1a31d3c-118f-3ab1-a82b-8a2a028da29a","product":{"name":"docker-buildx-0.33.0-160000.7.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e4fcdf05-e81a-3a8d-9b27-b1bae349c374","product":{"name":"docker-buildx-0.33.0-160000.7.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ecbe04d8-7a1e-3618-9f76-b13ddf09e245","product":{"name":"docker-rootless-extras-29.4.0_ce-160000.7.1.noarch","vendor":{"name":"SUSE"}}}]}},{"id":"ee90abfe-600c-31e5-a54a-a777b86e3141","advisory":{"id":"openSUSE-SU-2026:20809-1","description":"Security update for trivy","summary":"Security update for trivy","datePublished":"May 17, 2026, 9:24:43 PM","dateUpdated":"Sep 17, 2026, 5:33:12 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20809-1.json\nhttps://bugzilla.suse.com/1255366\nhttps://bugzilla.suse.com/1258094\nhttps://bugzilla.suse.com/1258513\nhttps://bugzilla.suse.com/1260193\nhttps://bugzilla.suse.com/1260971\nhttps://bugzilla.suse.com/1261052\nhttps://bugzilla.suse.com/1262389\nhttps://bugzilla.suse.com/1262893\nhttps://bugzilla.suse.com/1264873\nhttps://www.suse.com/security/cve/CVE-2025-64702/\nhttps://www.suse.com/security/cve/CVE-2025-69725/\nhttps://www.suse.com/security/cve/CVE-2026-25934/\nhttps://www.suse.com/security/cve/CVE-2026-33186/\nhttps://www.suse.com/security/cve/CVE-2026-33747/\nhttps://www.suse.com/security/cve/CVE-2026-33748/\nhttps://www.suse.com/security/cve/CVE-2026-34986/\nhttps://www.suse.com/security/cve/CVE-2026-39984/\nhttps://www.suse.com/security/cve/CVE-2026-41506/\n","aliases":"CVE-2025-64702\nCVE-2025-69725\nCVE-2026-25934\nCVE-2026-33186\nCVE-2026-33747\nCVE-2026-33748\nCVE-2026-34986\nCVE-2026-39984\nCVE-2026-41506\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"3f3115c0-91f2-3b03-b391-0e2941fea74c","product":{"name":"trivy-0:0.70.0-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"5844b879-e01e-39a4-a005-98aae6c7d1c0","product":{"name":"trivy-0:0.70.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6796540b-3e32-3248-b7bb-23f86403552e","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"94f6b2bb-4e7f-3b18-922e-c3598a5c8773","product":{"name":"trivy-0:0.70.0-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f8104325-73b4-3adc-9553-c62a57a33a19","product":{"name":"trivy-0:0.70.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"fc2ccd4e-69d3-395c-9c3f-e32075c0b5b3","advisory":{"id":"SUSE-SU-2026:22513-1","description":"Security update for docker","summary":"Security update for docker","datePublished":"Jul 2, 2026, 6:51:38 PM","dateUpdated":"Sep 20, 2026, 6:39:47 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22513-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202622513-1/\nhttps://lists.suse.com/pipermail/sle-security-updates/2026-July/027315.html\nhttps://bugzilla.suse.com/1262346\nhttps://bugzilla.suse.com/1265782\nhttps://bugzilla.suse.com/1266625\nhttps://bugzilla.suse.com/1267827\nhttps://www.suse.com/security/cve/CVE-2026-33814/\nhttps://www.suse.com/security/cve/CVE-2026-39821/\nhttps://www.suse.com/security/cve/CVE-2026-39984/\nhttps://www.suse.com/security/cve/CVE-2026-41567/\n","aliases":"CVE-2026-33814\nCVE-2026-39821\nCVE-2026-39984\nCVE-2026-41567\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"104274a8-bcee-3a3c-a5b9-529f56d555f6","product":{"name":"docker-buildx-0.33.0-11.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"219fab21-f1dc-3056-9f70-6cb7c8ec330d","product":{"name":"docker-29.4.0_ce-11.1.s390x","vendor":{"name":"SUSE"}}},{"id":"297f60d7-5180-3e85-8921-cda35176a63f","product":{"name":"docker-29.4.0_ce-11.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2ae895a5-1929-3501-bce6-ab9de6b627b8","product":{"name":"docker-buildx-0:0.33.0-11.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"5f7b8e1f-29cd-3ebc-a2b9-6d3360c1c405","product":{"name":"SUSE Linux Micro 6.0","vendor":{"name":"SUSE"}}},{"id":"6e13d537-bbf1-30bd-b353-cfcd3059613a","product":{"name":"docker-0:29.4.0_ce-11.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"83e856bc-b495-3de0-aaf0-8d3a67b99f7c","product":{"name":"docker-buildx-0.33.0-11.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"9b09a9e2-b8b3-33be-9b2a-318a6fa0d558","product":{"name":"docker-29.4.0_ce-11.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"9edd8b69-bffd-3cef-9e14-fae9f4dfd59f","product":{"name":"docker-buildx-0:0.33.0-11.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cacd235e-a8e6-3d5c-8723-ab37db10b0d4","product":{"name":"docker-0:29.4.0_ce-11.1.s390x","vendor":{"name":"SUSE"}}},{"id":"e06465cd-5455-3ce4-9d1f-c25dd99c747f","product":{"name":"docker-buildx-0:0.33.0-11.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"f152914d-351a-35f9-88c6-cc4271e8fbd7","product":{"name":"docker-buildx-0.33.0-11.1.s390x","vendor":{"name":"SUSE"}}},{"id":"f9a8bfce-fcbf-34b0-b338-a90e6fe6e309","product":{"name":"docker-0:29.4.0_ce-11.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}