Privasys

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 9.1CriticalOct 12, 2026Privasys ra-tls-clients Auth bypass / access controlCVE-2026-108362Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The
• 7.2HighOct 12, 2026Privasys ra-tls-clientsCVE-2026-108361Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of
• 9.1CriticalOct 9, 2026Privasys ra-tls-clients Auth bypass / access controlCVE-2026-108269Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the
• 9.1CriticalOct 9, 2026Privasys enclave-os-virtual Auth bypass / access controlCVE-2026-108268Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the a
• 9.1CriticalOct 9, 2026Privasys go Auth bypass / access controlCVE-2026-108267Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This iss
• 9.1CriticalOct 9, 2026Privasys rustls Auth bypass / access controlCVE-2026-108266Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested encl
• 9.1CriticalOct 9, 2026Privasys enclave-os-mini Auth bypass / access controlCVE-2026-108265Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. T

See every Privasys entry on the dashboard.

Top products

• ra-tls-clients3 CVEs in the last year, 2 critical
• rustls1 CVE in the last year, 1 critical
• go1 CVE in the last year, 1 critical
• enclave-os-virtual1 CVE in the last year, 1 critical
• enclave-os-mini1 CVE in the last year, 1 critical