libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping d...

CVE-2026-76234

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs.

历史摘要 · 未重新核验 · NVD

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signature_method para...

CVE-2026-72889

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves

历史摘要 · 未重新核验 · NVD

After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently ac...

CVE-2026-58085

After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC

历史摘要 · 未重新核验 · NVD

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] from an unverified t...

CVE-2026-55165

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_tok

历史摘要 · 未重新核验 · NVD

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tamper...

CVE-2025-9210

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows

历史摘要 · 未重新核验 · NVD

uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

## Summary The sigstore check on `metadata.json` is gated on the wrong side of the condition. `LoadMetadata` in `intern

历史摘要 · 未重新核验 · GitHub Advisory

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the...

CVE-2026-18500

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to

历史摘要 · 未重新核验 · NVD

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an...

CVE-2026-74244

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests...

CVE-2026-74244

CVE-2026-74244 是 Red Hat Quay 中 Stripe 计费 webhook 处理程序的一个安全缺陷。该漏洞源于 `/webhooks/stripe` 端点未正确验证 Stripe-Signature 请求头，导致未认

历史摘要 · 未重新核验 · NVD

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution...

CVE-2026-19910

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnera

历史摘要 · 未重新核验 · GitHub Advisory

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbit...

CVE-2026-19910

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnera

历史摘要 · 未重新核验 · NVD

kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prio...

CVE-2026-47192

kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and pro

历史摘要 · 未重新核验 · NVD

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equiv...

CVE-2026-47191

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or S

历史摘要 · 未重新核验 · NVD

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module ...

CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass

历史摘要 · 未重新核验 · NVD

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve...

CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This atta

历史摘要 · 未重新核验 · NVD

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

CVE-2026-28148

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

历史摘要 · 未重新核验 · NVD

Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML va...

CVE-2026-12263

Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an au

历史摘要 · 未重新核验 · NVD

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) agains...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed

历史摘要 · 未重新核验 · NVD

A holder of a valid integration credential may impersonate other users under specific conditions.

CVE-2026-68759

A holder of a valid integration credential may impersonate other users under specific conditions.

历史摘要 · 未重新核验 · NVD

A user with access to a valid SAML response may impersonate another user under specific conditions.

CVE-2026-68757

A user with access to a valid SAML response may impersonate another user under specific conditions.

历史摘要 · 未重新核验 · NVD