OpenPGP data signature accepted from a signing subkey without cross-certification
CVE-2026-71887
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey who
#cwe-345
共收录 416 条相关情报。
← 返回所有主题OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check
CVE-2026-85515
In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip be...
CVE-2026-104422
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptS
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever pee...
CVE-2026-104419
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 10
Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
CVE-2026-104422
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptS
Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes
CVE-2026-104419
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 10
Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lea...
CVE-2026-103878
Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended opera
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
CVE-2026-102831
## Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses cl
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header r...
CVE-2026-102140
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verifi
PyJWT: PyJWKClient follows redirects when fetching JWKS
CVE-2026-102267
### Summary PyJWT 2.13.0 `PyJWKClient` followed HTTP redirects while fetching a JWKS, without validating the redirect d
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, fro...
CVE-2026-102831
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
CVE-2026-102831
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit
Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_txm_module_manager_i...
CVE-2026-102711
Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxe...
CVE-2026-102677
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 unti
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
CVE-2026-102677
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 unti
A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the...
CVE-2026-101278
A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_
A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the com...
CVE-2026-101278
A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_
PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import p...
CVE-2026-102275
PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in j
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS t...
CVE-2026-102267
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because red
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing u...
CVE-2026-92996
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actu