CVE-2026-65626

The jose library (versions 1.3.0 before 1.11.13 ) contains a Bleichenbacher padding oracle in its pure-Erlang jose_jwa_pkcs1 module. The vulnerability arises because the eme_pkcs1_decode/2 and rsaes_pkcs1_decrypt/2 functions fail to implement implicit-rejection countermeasures (RFC 8017 §7.2.2), ...

SUSE CVE-2026-116189

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...

stego_provenance_defense

Decode-Time Provenance Binding for MCP Agents A reproducible proof-of-concept for a steganographic prompt-injection vector that defeats text content scanners, and a defense that contains it at the decode boundary — decode-time provenance binding. Educational / defensive security research only. Al...

CVE-2026-103319

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and...

wake-and-break

Wake and Break A PSP Platform Security Processor exploit for AMD navi31 cards RX 7900 series. Likely adaptable to other adjacent product families as well. It turns off the PSP's firmware signature check, so the card will load unsigned IP firmware SMU, SDMA, MEC, IMU, RLC that it would otherwise...

EUVD-2026-109621

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and...

CVE-2026-116189

A flaw was found in rclone. A remote attacker with the ability to tamper with the release distribution path can bypass cryptographic signature verification during the self-update process. By prepending an unsigned checksum before the signed checksum block, the attacker can cause the application t...

CVE-2026-116116

A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be...

CVE-2026-116116 Yoosee GM8135S Camera Secure Boot signature verification

A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be...

EUVD-2026-109608

A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be...

UBUNTU-CVE-2026-116189

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...

PT-2026-125208

An issue with signature validation was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in a privileged network position may be able to impersonate a Kerberos KDC...

UBUNTU-CVE-2026-115374

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz- headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto...

PT-2026-125111

Name of the Vulnerable Software and Affected Versions jose versions 1.3.0 through 1.11.12 Description The jose jwa pkcs1 module contains a Bleichenbacher padding oracle in its pure-Erlang RSAES-PKCS1-v1 5 decryption. The function eme pkcs1 decode/2 returns the recovered message for valid PKCS1 v1...

PT-2026-125117

Name of the Vulnerable Software and Affected Versions jose versions 1.0.0 through 1.11.12 Description The library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. During verification, the function jose jwk kty ec:verify/4 in src/jwk/jose jwk kty ec.erl split...

Linux Distros Unpatched Vulnerability : CVE-2026-116189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the...

Security Bulletin: IBM Db2 Bridge is vulnerable due to Authlib, urllib3, jackson-databind, source-map-js, Axios, and python-jose

Summary Authlib, urllib3, jackson-databind, source-map-js, Axios, and python-jose is used as part of IBM Db2 Bridge and it was affected by vulnerabilities described in the vulnerability details. This issue Affected users using Db2 Bridge 1.1.5.2 and new Fix pack was release to address the issue...

DEBIAN-CVE-2026-116189

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...

CVE-2026-116189

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...

CVE-2026-116189

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...