84 matches found
CVE-2026-59243
CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT signature bypass Korean: README.ko.md Apache advisory: https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl published 2026-07-29 CVE record: https://vulners.com/cve/CVE-2026-59243 Fixed in: apache-airflow-providers-fab==3.7.3 Class:...
EUVD-2026-94465
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...
CVE-2026-76482 Cisco License On-Prem Security Hardening Release
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...
CVE-2026-76482
The Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem ) software is affected by vulnerabilities categorized under CWE-347 , involving improper verification of cryptographic signatures . These issues were identified during an internal security review and are addressed through so...
CVE-2026-76482 Cisco License On-Prem Security Hardening Release
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...
Exploit for CVE-2026-82876
CVE-2026-82876 — Phison S11 SSD Firmware Signature Verificatio...
node-opcua missing nonce verification in UserNameIdentityToken authentication
Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...
GHSA-MQ36-523M-X7VV node-opcua missing nonce verification in UserNameIdentityToken authentication
Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...
Security Bulletin: Vulnerabilities found in Watson Data Intelligence
Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch4 Vulnerability Details CVEID:CVE-2026-48522 DESCRIPTION: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen whic...
Exploit for CVE-2026-9090
CVE-2026-9090 — Casdoor SAML Signature Bypass PoC Proof-of-...
CVE-2026-59243: Improper Verification of Cryptographic Signature
The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...
Exploit for Improper Verification of Cryptographic Signature in Apache Apache-Airflow-Providers-Fab
CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT signature...
📄 SAP NetWeaver ABAP / SAP_BASIS 918 Cryptographic Weakness
SAML response validation in NetWeaver's SAML Service Provider is susceptible to XML Signature wrapping attacks, specifically through Signature/Object tags. This allows an attacker to manipulate SAML assertion data returned by the identity provider, therefore enabling logging in as an arbitrary...
CVE-2026-33467: Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature CWE-347 in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing close...
Security Bulletin: Signature Verification Bypass Vulnerability in auth0/node-jws (HS256, ≤ v3.2.2 & v4.0.0) affects watsonx.data
Summary A vulnerability in auth0/node-jws allows attackers to bypass signature verification when using the HS256 algorithm under certain conditions. The issue occurs when applications rely on user-controlled data for HMAC secret lookup during verification. This can affect watsonx.data...
CVE-2025-46774: Improper Verification of Cryptographic Signature
An Improper Verification of Cryptographic Signature vulnerability CWE-347 in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to escalate their privileges via FortiClient related executables...
EUVD-2020-23826
Malware in sbrugna...
EUVD-2020-16277
Malware in sbrugna...