CVE-2026-29000

CVE-2026-29000: Proof of Concept PoC для обхода аутентификации pac4j-jwt ⚠️ Дисклеймер Этот инструмент предназначен только для образовательного и этического тестирования безопасности. Я не поддерживаю и не буду поддерживать вредоносные действия в каком-либо виде или форме. Используйте на свой стра...

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

SummaryThe Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data.Severity: CriticalCVSS 3.1:...

CVE-2026-59243_exploit

CVE-2026-59243 — Обход аутентификации OAuth в провайдере FAB Apache Airflow → RCE через DAG Обход аутентификации в провайдере FAB auth-manager Apache Airflow apache-airflow-providers-fab, приводящий к удалённому выполнению кода через запускаемый DAG. Провайдер декодирует Azure OAuthidtoken с...

CVE-2026-8888-Printer-Firmware-Unsigned-Update-via-HTTP

CVE-2026-8888 – Неподписанное обновление прошивки принтера через HTTP Программный код Python HTTP-сервер + эмулятор принтера !/usr/bin/env python3 printerfirmwareserver.py - Simulated printer that fetches updates over HTTP import requests, hashlib, os FIRMWAREURL =...

CVE-2026-94212 Apache APISIX: unauthenticated impersonation issue in saml-auth

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

CVE-2026-94212 Apache APISIX: unauthenticated impersonation issue in saml-auth

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

CVE-2026-103245

Versions of n8n prior to 1.123.80, 2.39.6, and 2.40.1 are vulnerable to a missing webhook signature verification flaw in the Webflow Trigger node webhook handler. The application fails to verify the x-webflow-signature HMAC, allowing unauthenticated attackers to send forged webhook requests with ...

CVE-2026-103245 n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

CVE-2026-103245 n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

BIT-KYVERNO-2026-100704 Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy policies.kyverno.io/v1beta1 evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource...

Rocky Linux 8 [CIQ] Security Update: dnf / dnf-automatic / dnf-data / dnf-plugins-core / libdnf / etc (crlsa-2021_4464)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214464 advisory. libdnf: Signature verification bypass via signature placed in the main RPM header CVE-2021-3445 Tenable has extracted the preceding description block directly from...

AlmaLinux 9.6 [TuxCare] Security Update: compat-openssl11 (ALMALINUX9.6:CLSA-2026:1785154072)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785154072 advisory. - Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impac...

CentOS Linux 8.4 [TuxCare] Security Update: perl-CPAN Multiple Vulnerabilities (CENTOS8.4:CLSA-2025:1758821935)

The CentOS Linux 8.4 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2025:1758821935 advisory. - CPAN 2.28 allows Signature Verification Bypass. CVE-2020-16156 - CPAN.pm before 2.35 does not verify TLS certificates when...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-3.1 / aspnetcore-targeting-pack-3.1 / etc Multiple Vulnerabilities (crlsa-2022_6057)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226057 advisory. dotnet: External Entity Injection during XML signature verification CVE-2022-34716 Tenable has extracted the preceding description block directly from the...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc (crlsa-2022_6058)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226058 advisory. dotnet: External Entity Injection during XML signature verification CVE-2022-34716 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: appstream-data / libxmlb / libxmlb-debuginfo / libxmlb-debugsource (crlsa-2020_4436)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20204436 advisory. fwupd: Possible bypass in signature verification CVE-2020-10759 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

CentOS Linux 8 [TuxCare] Security Update: perl-CPAN / perl-CPAN-tests (CENTOS-STREAM8:CLSA-2025:1758822139)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1758822139 advisory. - CPAN 2.28 allows Signature Verification Bypass. CVE-2020-16156 Note that Nessus has not tested for this issue but has instead relied on...

Rocky Linux 8 [CIQ] Security Update: gnutls / gnutls-c++ / gnutls-c++-debuginfo / gnutls-dane / etc (crlsa-2021_1206)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20211206 advisory. nettle: Out of bounds memory access in signature verification CVE-2021-20305 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.2:CLSA-2026:1782810335)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782810335 advisory. - The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or...

CentOS Linux 8 [TuxCare] Security Update: perl-ExtUtils-Embed / perl-IO-Zlib / perl-Locale-Maketext-Simple / etc (CENTOS-STREAM8:CLSA-2025:1750165585)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1750165585 advisory. - CPAN 2.28 allows Signature Verification Bypass. CVE-2020-16156 Note that Nessus has not tested for this issue but has instead relied on...