Forge: AES-GCM authentication bypass via unvalidated tagLength option
CVE-2026-119186
### Summary The AES-GCM mode in forge.cipher does not validate the tagLength option passed to start(). With a tagLength
#cwe-1284
共收录 182 条相关情报。
← 返回所有主题Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
CVE-2026-118782
### Summary forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero (or less) from the input, and t
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to ...
CVE-2026-115274
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service t...
CVE-2026-109821
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an a
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option pas...
CVE-2026-119186
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, nod
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based ...
CVE-2026-118782
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, nod
zip: AES Entry HMAC Authentication Bypass on Premature EOF
CVE-2026-115906
### Summary An AES-encrypted (AE-x) entry's authentication code is verified only when the reader's byte counter lands e
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
CVE-2026-116581
### Summary `fromJSON` and `fromCrossJSON` used two node fields without checking them. - An array node's element list
When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before valida...
CVE-2026-114349
When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between ...
CVE-2026-103594
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate...
CVE-2026-116581
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. P
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the atta...
CVE-2026-115906
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently,...
CVE-2026-92386
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with t...
CVE-2026-94024
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_...
CVE-2026-93475
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts in
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued...
CVE-2026-91041
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log rep
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an...
CVE-2026-112112
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject F
swoosh has email-derived URL path injection in Microsoft Graph endpoint
CVE-2026-54893
### Summary `Swoosh.Adapters.MsGraph` builds its Microsoft Graph API request URL by interpolating the sender's email ad
An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to ...
CVE-2026-101987
An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Juno
An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory ...
CVE-2026-101974
An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evo