VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

CERT/CC advisories describe multiple vulnerabilities across TPM 2.0 reference code, OpenCart, stb_truetype, SOGo, VPS.org deployment templates, SGLang, and foreUP. Impacts include unauthenticated or privileged remote code execution, directory traversal and web-shell creation, XSS with mailbox compromise, cryptographic key and credential disclosure, exposed databases and default secrets, SSRF and local file read, payment credential exposure, and broken object-level authorization. Several issues lack patches, while SOGo recommends upgrading to 5.12.8 or newer.