14768 matches found
CVE-2026-84483: Use of Hard-coded Cryptographic Key
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hashhmac with the site's...
CVE-2026-82876: Improper Verification of Cryptographic Signature
Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the...
CVE-2026-76133: Use of a Broken or Risky Cryptographic Algorithm
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate...
CVE-2026-75759
Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...
EUVD-2026-68145
Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...
CVE-2026-75759: Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...
CVE-2026-82645: Improper Verification of Cryptographic Signature
AVideo current commit e01e41ecc and earlier exposes stream credentials through the plugin/Live/view/Liverestreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream access gate and the restream ownership check, causing the endpoint to return any...
Improper Verification of Cryptographic Signature
Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature when extracting Keycloak realm and client roles due to missing verification of access token signatures, issuers, audiences, or expiry. An attacker can gain unauthorized privileges by...
ziti v2.0.4
OpenZiti OpenZiti is an open-source zero-trust networking platform that makes network services invisible to unauthorized users. Every connection, whether from a user, a service, a device, or a workload, is authenticated with cryptographic identity, authorized by policy, and encrypted end-to-end...
CVE-2026-82461: Improper Verification of Cryptographic Signature
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...
CVE-2025-36271
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...
CVE-2025-36271 IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...
[SECURITY] Fedora 44 Update: python-cryptography-50.0.0-1.fc44
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to Cryptographic Weakness in IBM Liberty Server ( CVE-2020-36732)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the cryptographic weakness vulnerability Vulnerability Details CVEID:CVE-2020-36732 DESCRIPTION: The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an intege...
PT-2026-83319
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...
PT-2026-83370
Name of the Vulnerable Software and Affected Versions free5GC versions prior to 1.4.5 Description The AUSF component uses non-constant-time equality helpers for cryptographic authentication comparisons in internal/sbi/processor/ue authentication.go. Specifically, the...
OpenSSH Cryptographic Protection Control Flow Data Compromise
The vulnerability of the OpenSSH cryptographic protection lies in the implementation of an incorrect control flow. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data remotely...
OpenSSH Cryptographic Protection Mechanism Data Compromise
The vulnerability of the OpenSSH cryptographic protection lies in the use of an unprotected alternative channel. Exploiting this vulnerability could allow a attacker to compromise the integrity of data...
OpenSSH Cryptographic Protection Mechanism
The vulnerability of the OpenSSH cryptographic protection lies in the improper execution of certain operations. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise the integrity of those data...