CVE-2026-97468

A flaw was found in Apache CXF. The Security Token Service STS and token validation components cache validated security tokens using a weak, non-cryptographic hash function and treat cache matches as proof of validity. A remote attacker can craft a security token that generates a hash collision...

CVE-2026-84271

IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-84271 IBM Guardium Data Protection Signature Verification Bypass

IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-84271

IBM Guardium Data Protection 12.2 contains a signature verification bypass vulnerability within the patch installer. An attacker with local access could exploit this flaw to achieve arbitrary code execution with root privileges . The root cause is identified as a race condition (CWE-362). No spec...

EUVD-2026-95240

IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...

Exploit for Improper Verification of Cryptographic Signature in Wso2 Api_Control_Plane

CVE-2026-5430 — WSO2 API Manager JWT Algorithm Bypass Det...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

CVE-2020-10759-poc

요약 CVE-2020-10759 - fwupd PGP 서명 확인 우회를 악용합니다. 자세한 내용은 https://github.com/justinsteven/advisories/blob/master/2020fwupddanglings3bucketandCVE-2020-10759signatureverificationbypass.md 을 참조하십시오. 요구 사항 참고: OS 공급업체에서 python3-gpg를 설치해야 합니다. 이 모듈은 시스템의 libgpgme 설치와 일치해야 하므로 pip를 통해 설치하는 것을 좋아하지 않습니다. a...

CVE-2026-105163

A flaw was found in crossplane-runtime. A malicious container registry can bypass package signature verification when packages are installed using tag references instead of fixed content digests. Because the package manager resolves the image tag separately during verification and retrieval, an...

Starlink-FI

Starlink ユーザーターミナル Modchip このリポジトリは、「Glitched on Earth by Humans: A Black-Box Security Evaluation of the SpaceX Starlink User Terminal」という講演に付随するものです。 スライド資料はこちらから入手できます。講演の録画は近日公開予定です。 この講演では、電圧フォールトインジェクションを行うカスタムModchipを使用して、Starlinkユーザーターミナル上で任意のコードを実行した方法について説明します。 このModchipは、System-on-Chip...

CVE-2026-47554

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signatures may cause signature verification to be bypassed under memory pressure. A successful exploit of this vulnerability might lead to denial of service and data...

PYSEC-2026-4106 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

SummaryThe Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data.Severity: CriticalCVSS 3.1:...

BIT-KYVERNO-2026-100704 Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy policies.kyverno.io/v1beta1 evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource...

Rocky Linux 8 [CIQ] Security Update: appstream-data / libxmlb / libxmlb-debuginfo / libxmlb-debugsource (crlsa-2020_4436)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20204436 advisory. fwupd: Possible bypass in signature verification CVE-2020-10759 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

CentOS Linux 8.4 [TuxCare] Security Update: perl-CPAN Multiple Vulnerabilities (CENTOS8.4:CLSA-2025:1758821935)

The CentOS Linux 8.4 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2025:1758821935 advisory. - CPAN 2.28 allows Signature Verification Bypass. CVE-2020-16156 - CPAN.pm before 2.35 does not verify TLS certificates when...

CentOS Linux 8 [TuxCare] Security Update: perl-ExtUtils-Embed / perl-IO-Zlib / perl-Locale-Maketext-Simple / etc (CENTOS-STREAM8:CLSA-2025:1750165585)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1750165585 advisory. - CPAN 2.28 allows Signature Verification Bypass. CVE-2020-16156 Note that Nessus has not tested for this issue but has instead relied on...