Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

CVE-2026-18092 Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because newfromxml reads assertion identity with document-wide XPath instead of the signed subtree. newfromxml reads the NameID, attribute values, SessionIndex, audience and other identity fields...

dnscontrol v5.0.0-rc4

DNSControl DNSControl is Infrastructure as Code for DNS. It includes a full-featured configuration language Javascript-compatible, plus "plug-ins" that speak to DNS provider APIs such as AWS Route 53, Cloudflare, and Gandi. It can send the same DNS records to multiple providers. It runs anywhere ...

CVE-2026-18108

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verifyencryptedassertion accepts an EncryptedAssertion whose decrypted content carries no signature. verifyencryptedassertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via...

Inefficient Algorithmic Complexity

Overview org.bouncycastle:bcprov-jdk16 is a Bouncy Castle Crypto package that is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.6. Affected versions of this package are vulnerable to Inefficie...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the IETFUtils.valueToString method, reached through X500Name.toString, equals, and hashCode via AbstractX500NameStyle, which escapes each special character with vBuf.insertindex, "\" on the same...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the check method of ProvOcspRevocationChecker, which verifies a stapled OCSP response's signature and then treats the certificate as unrevoked when no SingleResponse entry matches its CertID, without...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the check method of ProvOcspRevocationChecker, which verifies a stapled OCSP response's signature and then treats the certificate as unrevoked when no SingleResponse entry matches its CertID, without...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the check method of ProvOcspRevocationChecker, which verifies a stapled OCSP response's signature and then treats the certificate as unrevoked when no SingleResponse entry matches its CertID, without...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-ext-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the force method of LazyEncodedSequence, which parses the deferred SEQUENCE with a fresh ASN1InputStream whose nesting-depth counter is reset rather than inherited from the parent parse, and never calls...

Uncontrolled Recursion

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Uncontrolled Recursion in the force method of LazyEncodedSequence, which parses the deferred SEQUENCE with a fresh ASN1InputStream whose nesting-dep...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the force method of LazyEncodedSequence, which parses the deferred SEQUENCE with a fresh ASN1InputStream whose nesting-depth counter is reset rather than inherited from the parent parse, and never calls...

Uncontrolled Recursion

Overview org.bouncycastle:bcprov-ext-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Uncontrolled Recursion in the force method of LazyEncodedSequence, which parses the deferred SEQUENCE with a fresh ASN1InputStream whose nesting-dep...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the BcKeyStoreSpi.engineLoad method, which sizes buffers for the certificate chain array, encoded certificates, encoded key material, entry data, and PBE salts directly from readInt length...

Uncontrolled Recursion

Overview org.bouncycastle.bcprov-jdk15on.1.57.org.bouncycastle:bcprov-jdk15on is a Java implementation of Bouncy Castle cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8. Affected versions of this package ar...