19234 matches found
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601
Versions of Electrum before 4.8.3 are vulnerable to a flaw where the software fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions. This allows malicious servers to replace a recently broadcast transaction with a conflicting one. An attacker can effectively
CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-103325
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...
EUVD-2026-110632
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...
CLEANSTART-2026-JA94279 Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module
Security vulnerability affects the wildfly package. Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module...
[SECURITY] [DLA 4864-1] swupdate security update
Debian LTS Advisory DLA-4864-1 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara October 26, 2026 https://wiki.debian.org/LTS Package : swupdate Version : 2022.12+dfsg-4+deb12u3 CVE ID : CVE-2025-41259 CVE-2026-109399 Two vulnerabilities were discovered ...
VulnCheck KEV: CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
Debian dla-4864 : libswupdate-dev - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4864 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4864-1 [email protected]...
Linux Distros Unpatched Vulnerability : CVE-2026-65632
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/...
PT-2026-125879
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...
PT-2026-126431
Name of the Vulnerable Software and Affected Versions Electrum versions prior to 4.8.3 Description The software fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions. This allows malicious servers to replace a recently broadcast transaction with a conflicting one...
PT-2026-126432
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init .py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data...
Linux Distros Unpatched Vulnerability : CVE-2026-115374
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject...
CVE-2026-116825
The YesWiki software (versions 4.6.2 before 4.7.0 ) is vulnerable to an HTTP Signature Replay attack via the ActivityPub Inbox. The root cause is located in HttpSignatureService::verifySignature(), which fails to validate the Date header or track previously seen signatures. An attacker who captur...
CVE-2026-116825 YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...
CVE-2026-116825 YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...
CVE-2026-112518
An issue with signature validation was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in a privileged network position may be able to impersonate a Kerberos KDC...
CVE-2026-112518
An issue with signature validation affects several Apple platforms, including iOS , iPadOS , macOS Golden Gate , tvOS , visionOS , and watchOS . The root cause stems from insufficient checks, which could allow an attacker in a privileged network position to impersonate a Kerberos KDC . This vulne...
CVE-2026-112518
An issue with signature validation was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in a privileged network position may be able to impersonate a Kerberos KDC...