Improper OCSP response validation in Snowflake drivers
CVE-2026-85525
Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certifica
#cwe-347
共收录 355 条相关情报。
← 返回所有主题Improper verification of cryptographic signature in Copilot Studio allows an unauthorized...
CVE-2026-80098
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-80098
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a ...
CVE-2026-84185
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE)
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers hol...
CVE-2026-85394
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded publi
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes ins...
CVE-2026-85393
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 sign
python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret
CVE-2024-33663 · CVE-2026-85394
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded publi
node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding
CVE-2026-33894 · CVE-2026-85393
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 sign
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), Mendix SAML (Mendi...
CVE-2026-80465
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 1
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_s...
CVE-2026-82955
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance in
Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attacke...
CVE-2026-82876
Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image
AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live...
CVE-2026-82645
AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/get
AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request pa...
CVE-2026-82645
AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/get
Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JA...
CVE-2026-75759
本次CVE涉及erlef oidcc库的加密签名验证不当问题。OpenID Connect Core规范要求，加密的ID令牌必须先签名再加密，形成嵌套JWT，而JARM响应也必须无条件验证签名。然而，oidcc在验证过程中，对于仅包含加密但
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry...
CVE-2026-82461
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens...
CVE-2026-82461
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak
pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token
CVE-2026-82461
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication...
CVE-2026-82454
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in toke
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted t...
CVE-2026-82454
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in toke
AIIR verification and policy gates could report success without enforcing the control (fail-open)
### Summary Several of AIIR's verification and policy paths could return a success/"verified" result without actually en