VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

CERT/CC advisories describe multiple 2026 vulnerabilities affecting TPM 2.0 reference code, OpenCart, stb_truetype, SOGo, VPS.org deployment templates, SGLang, and foreUP. Impacts include unauthenticated or privileged remote code execution, timing and information-leakage side channels, directory traversal to web-shell placement, memory disclosure and denial of service, stored or reflected XSS with mailbox compromise, default-credential exposure, SSRF and local file disclosure, credential and payment-data exposure, and broken object-level authorization. Several issues lack patches, while SOGo 5