PT-2026-33497

Name of the Vulnerable Software and Affected Versions Microsoft-signed third-party bootloader affected versions not specified Description A security-feature bypass allows attackers to affect the system. A Microsoft-signed third-party bootloader completely skips signature verification when loading...

PT-2026-34234

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z Description An authentication bypass exists in the STREAMING-UNSIGNED-PAYLOAD-TRAILER code path. An attacker possessing a valid access key can write arbitrary...

The vulnerability of GnuPG’s information encryption and digital signatures software, related to errors in verifying cryptographic signatures, allows attackers to circumvent existing security mechanisms.

The vulnerability of GnuPG’s information encryption and digital signatures lies in errors in verifying the cryptographic signature. Exploiting this vulnerability could allow attackers to circumvent existing security mechanisms...

The vulnerability of the Microsoft Teams integration package with the security platforms Cortex XSOAR and Cortex XSIAM arises from improper verification of the cryptographic signature. This allows an attacker to gain access to read and modify data.

The vulnerability of the Microsoft Teams integration package with the security platforms Cortex XSOAR and Cortex XSIAM is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker operating remotely to gain read and modify access to data...

PT-2026-95379

Name of the Vulnerable Software and Affected Versions rustls-webpki versions 0.101.0 through 0.103.11 rustls-webpki versions 0.104.0-alpha through 0.104.0-alpha.5 Description The software ignores X.509 name constraints that apply to URI names, causing these constraints to be accepted instead of...

PT-2026-95380

Name of the Vulnerable Software and Affected Versions rustls-webpki versions 0.101.0 through 0.103.11 rustls-webpki versions 0.104.0-alpha.0 through 0.104.0-alpha.5 Description Permitted subtree DNS name constraints are incorrectly accepted for certificates asserting a wildcard name. For instance...

CVE-2026-24032: Improper Verification of Cryptographic Signature

A vulnerability has been identified in SINEC NMS All versions V4.0 SP3 with UMC. The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component. This could allow an unauthenticated remote attacker to bypass authentication and gain...

PT-2026-33217

Name of the Vulnerable Software and Affected Versions monetr versions prior to 1.12.4 Description The public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. A remote unauthenticated attacker can send oversized POST payloads to the...

EUVD-2026-21899

An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources...

CVE-2026-0234 Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration

An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources...

Palo Alto Networks Cortex XSOAR 安全漏洞

Palo Alto Networks Cortex XSOAR is an application software developed by Palo Alto Networks in the United States. It provides a security orchestration, automation, and response platform, along with threat intelligence management and a built-in marketplace. There are security vulnerabilities in Pal...

PT-2026-32427

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance .prov file when signature verification is required. This vulnerability is fixed in 4.1.4...

CVE-2026-0234: Improper Verification of Cryptographic Signature

An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources...

SUSE CVE-2026-35205

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance .prov file when signature verification is required. This vulnerability is fixed in 4.1.4...

SUSE CVE-2026-39853

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS7 signature, the code copies the digest value from a parsed...

CVE-2026-35205

A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a malicious plugin that lacks a provenance file. Even when signature verification is enabled, Helm would incorrectly install this unverified plugin, bypassing critical...

CVE-2026-35665

OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout before signature verification. An unauthenticated attacker can exhaust server connection resources by sending...

CVE-2026-35665 OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing

OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout before signature verification. An unauthenticated attacker can exhaust server connection resources by sending...

CVE-2026-35665 OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing

OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout before signature verification. An unauthenticated attacker can exhaust server connection resources by sending...

CVE-2026-35665 OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing

OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout before signature verification. An unauthenticated attacker can exhaust server connection resources by sending...