Advisory 4

• OpenSSL's ARM64 SM2 Path Leaks a Private-Key Timing Fingerprint May 9, 2026
• ML-DSA Forgery, Part 2: Off-Process Key Recovery in wolfSSL Apr 17, 2026
• A 992-Byte PDF That Crashes Poppler (and an lcms2 Bug That Also Hits OpenJDK and Friends) Apr 17, 2026
• "Shall Destroy, Did Not": Recovering ML-DSA Private Keys from wolfSSL's Heap Apr 13, 2026