127 matches found
EulerOS 2.0 SP13 : python-paramiko (EulerOS-SA-2026-3041)
According to the versions of the python-paramiko packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.CVE-2026-44405 Tenable has extracted the preceding...
EulerOS 2.0 SP13 : python-paramiko (EulerOS-SA-2026-2991)
According to the versions of the python-paramiko packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.CVE-2026-44405 Tenable has extracted the preceding...
Improper Verification of Cryptographic Signature
Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the OnePassSignatures.verify method of OpenPGPMessageInputStream, whose catch PGPSignatureException block for the dataSignature.sanitizekey, policy check contains only a // continue...
The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library allows a hacker to bypass existing security mechanisms.
The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library is related to the use of the outdated SHA-1 cryptographic algorithm. Exploiting this vulnerability allows a remote attacker to bypass existing security measures...
MiracleLinux 8 : libreswan-4.12-2.el8_10.6 (AXSA:2026-1390:01)
The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1390:01 advisory. librenswan: IKEv1 Denial of Service via RSA-SHA1 PKCS1 Version 1.5 Encrypted authentication payload CVE-2026-50721 librenswan: IKEv2 Denial of Servi...
librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload
A flaw was found in Libreswan's implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v15 scheme. The RSAauthenticatehashsignaturepkcs115rsa function does not correctly validate the DER encoding of the ASN.1 digest. A remote, unauthenticated attacker could...
CVE-2026-13577
The CVE-2026-13577 entry affects Dancer2 for Perl up to version 2.1.0. When secure PRNG sources (Math::Random::ISAAC::XS, Crypt::URandom) are unavailable, Dancer2::Core::Role::SessionFactory::generate_id falls back to a low-entropy, rand-derived session id. The fallback is computed from a SHA-1 h...
Security update for python-paramiko
This update for python-paramiko fixes the following issues: CVE-2026-44405: data integrity compromise due to allowed SHA-1 algorithm use bsc1264225. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...
SUSE-SU-2026:3031-1 Security update for python-paramiko
This update for python-paramiko fixes the following issues: - CVE-2026-44405: data integrity compromise due to allowed SHA-1 algorithm use bsc1264225...
JLSEC-2026-750 Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5...
Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing...
CVE-2026-54780
CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference...
CVE-2026-54780 CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference...
CVE-2026-54780
CoreWCF WS-Security 1.0 receive pipeline does not validate ds:Reference DigestMethod while validating ds:SignedInfo SignatureMethod, allowing a rejection of digest algorithms (e.g., SHA-1) to be bypassed in affected versions. Affected components include CoreWCF and CoreWCF.Primitives; fixed in Co...
PT-2026-55217
Name of the Vulnerable Software and Affected Versions CrateDB versions prior to 6.2.8 CrateDB versions prior to 6.3.2 Description An authorization bypass exists in the blob HTTP API of CrateDB. While the SQL path for accessing blob storage correctly enforces privilege grants via AccessControl, th...
Linux Distros Unpatched Vulnerability : CVE-2026-6412
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing. CVE-2026-6412 Note that Nessus...
CVE-2026-39031
Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored in cleartext alongside the ciphertext. This allows an attacker with local access to recover any encrypted password to plaintext using a...
CVE-2026-6412
Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing...
DEBIAN-CVE-2026-6412
Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing...