79 matches found
CVE-2026-88981
In versions prior to 2.18.0 , Kubeflow Pipelines is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The issue exists because the frontend artifact download path (for source=s3 or source=minio) and the archived pod-log path accept providerInfo.Params.endpoint and S3-compatibl...
Microsoft Active Directory Certificate Services Windows Server 2025 Subject Key Identifier Spoofing
Microsoft Active Directory Certificate Services on Windows Server 2025 versions before 10.0.26100.3775 contains a weak authentication vulnerability that allows an authorized attacker to elevate privileges by supplying a chosen Subject Key Identifier during certificate enrollment...
CVE-2026-109940
A flaw was found in FreeRDP. An attacker who supplies a malicious or compromised Public-Key Cryptography Standards PKCS11 token can cause a Denial of Service DoS by crashing the client application. During key enumeration, FreeRDP processes key identifier attributes into a fixed-size stack buffer...
Windows Server 2025 Active Directory Certificate Services Subject Key Identifier Injection
Windows Server 2025 Active Directory Certificate Services contains a weak authentication issue that allows an authorized attacker to inject an arbitrary Subject Key Identifier into a certificate signing request. https://packetstorm.news/download/237875...
CVE-2026-87676: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsing uploaded X.509 PEM certificates for management display, the system improperly validates the length of the Authority Key Identifier AKI extension before...
CLSA-2026-1789474778 openssl: Fix of CVE-2026-31789
CVE-2026-31789: bound the length passed to hextostring so the hex buffer size computation cannot overflow when printing Subject Key Identifier or Authority Key Identifier extensions...
CLSA-2026-1789474979 openssl: Fix of CVE-2026-31789
CVE-2026-31789: bound the length passed to hextostring so the hex buffer size computation cannot overflow when printing Subject Key Identifier or Authority Key Identifier extensions...
CLSA-2026-1789474528 openssl: Fix of CVE-2026-31789
CVE-2026-31789: bound the length passed to hextostring so the hex buffer size computation cannot overflow when printing Subject Key Identifier or Authority Key Identifier extensions...
CVE-2026-84962 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...
CVE-2026-84962 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...
JLSEC-2026-700 Out-of-bounds heap read during SM2/SM3 certificate signature verification
Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier computation reads the trailing 65 bytes of the public key without checking that the key is at least that long. A public key shorter than 65...
JLSEC-2026-723 Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion
Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion. A heap buffer overflow occurs when converting an X.509 certificate internally due to incorrect size handling of the AuthorityKeyIdentifier extension...
EUVD-2026-43573
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3EXTd2iext returns NULL when an extension's DER value fails to parse. basicC, ia5string, and authatt dereference its result without a NULL check. keyiddata also dereferences akid-keyid,...
CVE-2026-38059 ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function
The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID DID, Terminal Private Key identifier TPK, MAC address, and exact firmwa...
MINI-W7F9-HJM8-XGHP
Bulletin has no description...
Improper Verification of Cryptographic Signature
Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the JWKS key caching process. An attacker can gain unauthorized access to another issuer or tenant's resources by crafting a valid token for one allowed issuer and exploiting the cache...
PT-2026-55127
Summary Centrifugo's dynamic JWKS endpoint feature can verify a JWT for one allowed issuer using a public key cached from another allowed issuer. The JWKS cache and singleflight lookup are keyed only by the JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or other trust-domain...
CVE-2026-12340
Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier computation reads the trailing 65 bytes of the public key without checking that the key is at least that long. A public key shorter than 65...
CVE-2026-12340 Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computation
Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier computation reads the trailing 65 bytes of the public key without checking that the key is at least that long. A public key shorter than 65...
CVE-2026-12340 Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computation
Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier computation reads the trailing 65 bytes of the public key without checking that the key is at least that long. A public key shorter than 65...