2903 matches found
CVE-2026-4258
Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH...
CVE-2026-4258
Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH...
CVE-2026-4258
Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH...
sjcl 安全漏洞
sjcl is a deprecated JavaScript encryption library developed by bitwiseshiftleft. Sjcl has a security vulnerability, which stems from the lack of point-to-point verification in sjcl.ecc.basicKey.publicKey. This vulnerability could allow attackers to recover the victim’s ECDH private key by sendin...
Veeam Agent for Linux: Update Blocked by Repository Signing Key Change
Article Applicability This article is intended for customers managing Veeam Agent for Linux 6.3 deployments. Deployments that have already been updated to Veeam Agent for Linux 13, or are being updated to it, are not affected by the repository GPG key change. Challenge When attempting to update...
CLSA-2026-1773653586 curl: Fix of CVE-2025-15224
CVE-2025-15224: fix libssh public-key auth fallback to SSH agent...
EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-1532)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that...
EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-1355)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When doing multi-threaded LDAPS transfers LDAP over TLS with libcurl, changing TLS options in one thread would inadvertently change them globally an...
EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-1331)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP,...
CLSA-2026-1773412568 Fix CVE(s): CVE-2025-15224
SECURITY UPDATE: unexpected SSH agent authentication during public-key SSH- based transfers - debian/patches/CVE-2025-15224.patch: Require private key or SSH agent for public-key authentication; prevent attempted public-key auth when neither private key nor agent present; fix missing check that...
CLSA-2026-1773405854 curl: Fix of CVE-2025-15224
CVE-2025-15224: fix libssh public-key auth fallback to SSH agent...
CLSA-2026-1773405202 curl: Fix of CVE-2025-15224
CVE-2025-15224: fix libssh public-key auth fallback to SSH agent...
FoSAM: Forward Secret Messaging in Ad-Hoc Networks
Apps such as Firechat and Bridgefy have been used during recent protests in Hong Kong and Iran, as they allow communication over ad-hoc wireless networks even when internet access is restricted. However, these apps do not provide sufficient protection as they do not achieve forward secrecy in...
Oracle Linux 9 : compat-openssl11 (ELSA-2026-4472)
The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-4472 advisory. 1:1.1.1k-5.2 - Fixes CVE-2025-69419 OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS12 processing Resolves: RHEL-142722 Tenable has extracte...
[SECURITY] Fedora 44 Update: nss-3.120.1-1.fc44
Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...
CVE-2026-30223 OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" local RSA public key or "authJwtHmacSecret" HMAC secret, the configured audience value authJwtAud is not enforced during toke...
CVE-2026-29000
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT wi...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation in the authentication process when JWT tokens are parsed without enforcing the audience claim in certain configurations. An attacker can gain unauthorized access by presenting a validly signed JWT token with an...
GHSA-G962-2J28-3CG9 OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes
Summary When JWT authentication is configured using either: - authJwtPubKeyPath local RSA public key, or - authJwtHmacSecret HMAC secret, the configured audience value authJwtAud is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted...