4537 matches found
EUVD-2026-72731
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server...
CVE-2026-77105 CommServe Privilege Escalation
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server...
PT-2026-88511
Impact The GitHub Trigger generated a signing secret when it registered a webhook and verified X-Hub-Signature-256 on each delivery. When GitHub answered the create request with a 422 because a webhook for the URL already existed, the node adopted the remote hook but kept only its id and events,...
Fedora 43 : perl-Net-OAuth (2026-370bd8b5f0)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-370bd8b5f0 advisory. Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non- constant-time comparison in verify. This update...
Security update for systemd (moderate)
openSUSE security update: security update for systemd ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21754-1 Rating: moderate References: bsc1237515 bsc1254924 bsc1259418 bsc1259650 bsc1261400 bsc1271444 Cross-References: CVE-2026-16742...
PT-2026-87049
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server...
PT-2026-88289
Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network...
CVE-2026-69646: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network...
CVE-2026-73314: Improper Check for Unusual or Exceptional Conditions
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported authalgo header value. When the algorithm cannot be mapped to a...
CVE-2026-77105: Improper Verification of Cryptographic Signature
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server...
Fedora 44 : perl-Net-OAuth (2026-e33554bf9f)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e33554bf9f advisory. Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non- constant-time comparison in verify. This update...
CVE-2026-86304
MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parseassertion builds Net::SAML2::Binding::POST without a trust anchor. parseassertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST-new with no cacert, certtext or anchors...
CVE-2026-86304 MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor
MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parseassertion builds Net::SAML2::Binding::POST without a trust anchor. parseassertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST-new with no cacert, certtext or anchors...
CVE-2026-13447
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...
EUVD-2026-71838
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...
CVE-2026-13447 MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...
CVE-2026-13447 MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...
CVE-2026-52767 YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature checks the result of PHP's opensslverify with a loose boolean negation - if !opensslverify... throw ... . PHP's opensslverify has four possible return values: 1, 0, -1, and...
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-45022 DESCRIPTION: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed...
