CVE-2026-87866

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...

EUVD-2026-105312

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

CVE-2026-87865

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

CVE-2026-87865

When libcurl uses libssh2 with a hashed "knownhosts" file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the "CURLOPTSSHKEYFUNCTION" callback...

CVE-2026-87865

A flaw exists in libcurl when used with the libssh2 backend and a hashed known_hosts file . An unrelated initial entry can cause host key validation to incorrectly report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. A remote attacker who intercepts or controls the SSH ...

CVE-2026-87865

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

9router <=0.5.4 - Authentication Bypass

9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation...

Gemini-api-key-hunter

Gemini API Key Toolkit A toolkit for discovering, validating, and testing exposed Google Gemini API keys. It consists of two components: Gemisc.py – A high-speed Python scanner that discovers exposed Google API keys from websites and JavaScript files, verifies them against the Gemini API, and...

CVE-2025-1234-RSA-Key-Validation-Bypass

CVE-2025-1234-RSA-Key-Validation-Bypass A flaw in a popular RSA implementation allows attackers to bypass key validation by supplying a modulus that appears valid but is actually factorable — if you can factor it quickly. CVE‑2025‑1234 — RSA Key Validation Bypass Exploit Proof‑of‑concept exploit...

knownhost callback mismatches key as missing

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

CVE-2026-87865

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

UBUNTU-CVE-2026-87865

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

PT-2026-114421

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 8.23.0-1.1 Description When libcurl utilizes libssh2 with a hashed known hosts file, an unrelated initial entry can lead to incorrect host key validation. Specifically, the system may report a key mismatch as a missin...

EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-4129)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : 'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse LOW', 'CVE-2026-8458: wrong reuse for different services LOW', 'CVE-2026-8924:...

keyhacks

KeyHacks muestra métodos para validar diferentes claves de API encontradas en un programa Bug Bounty o una prueba de penetración. @Gwen001 ha automatizado todo el proceso disponible aquí y se puede encontrar aquí Tabla de Contenidos Clave de API de ABTasty Clave de API de Algolia Claves de API de...

CVE-2026-71891

A flaw was found in Bouncy Castle. When validating Boneh-Lynn-Shacham BLS signature public keys, the library does not verify that a key is constructed on the canonical elliptic curve. An attacker can exploit this issue by supplying a specially crafted public key defined on an alternate curve. Thi...

UBUNTU-CVE-2026-71891

In Bouncy Castle for Java before 1.86, BLS12381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field...

CVE-2026-71891 BLS12-381 key validation accepts a public key built on a foreign curve

In Bouncy Castle for Java before 1.86, BLS12381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field...

CVE-2026-71891 BLS12-381 key validation accepts a public key built on a foreign curve

In Bouncy Castle for Java before 1.86, BLS12381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field...

CVE-2026-71891 BLS12-381 key validation accepts a public key built on a foreign curve

In Bouncy Castle for Java before 1.86, BLS12381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field...