VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

CERT/CC advisories disclose multiple 2026 vulnerabilities affecting TPM 2.0 reference code, OpenCart, stb_truetype, SOGo, VPS.org deployment templates, SGLang, and foreUP. Issues include timing and cryptographic side channels, directory traversal enabling web-shell deployment, heap out-of-bounds reads, stored XSS with potential mailbox compromise, exposed default credentials and secrets, unauthenticated RCE and SSRF, and API authorization and payment-credential disclosure. Several vulnerabilities are actively exploitable or lack patches, creating significant confidentiality, integrity, and, in