EUVD-2026-62479

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

PT-2026-78701

Name of the Vulnerable Software and Affected Versions mce-operator-bundle affected versions not specified Description The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning fixing a specific version of a commit or...

PT-2026-78636

Name of the Vulnerable Software and Affected Versions RDK-B WebUI version rdkb-2025q4-kirkstone Description Improper cryptographic signature verification in the jst functions.c file allows a remote, unauthenticated attacker to bypass authentication and obtain administrative access. The issue occu...

CVE-2026-50720

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

CVE-2026-50719

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

GO-2026-6246 uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set in gitlab.com/uniget-org/cli

uniget CLI: Metadata signature verification only runs when UNIGETIGNOREMETADATASIGNATURE is set in gitlab.com/uniget-org/cli...

PT-2026-80463

uniget CLI: Metadata signature verification only runs when UNIGET IGNORE METADATA SIGNATURE is set in gitlab.com/uniget-org/cli...

CVE-2021-43716: Improper Verification of Cryptographic Signature

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by encrypted firmware through USB...

uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...

PYSEC-2026-3756

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

EUVD-2026-60095

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

ROS-20260817-73-0218

The vulnerability of the command-line tool openssl dgst from the OpenSSL library is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker to influence the integrity of the protected information...

PT-2026-76612

openssl encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from dict that creates key bundles from untrusted data without verifying signatures. Attackers can call from dict followed by to identity without signature verification to encrypt data using attacker-controlled publi...

Unity Linux 20.1070a Security Update: compat-openssl10 (UTSA-2026-099546)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099546 advisory. Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact summary: A use-after-fre...

Exploit for CVE-2026-9090

CVE-2026-9090 — Casdoor SAML Signature Bypass PoC Proof-of-...

CVE-2026-24882 vulnerabilities

Vulnerabilities for packages: gnupg...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, victoriametrics-cluster, flux-source-controller, terraform-provider-azapi, lvm-driver, mariadb-operator, lazygit, spire-controller-manager, containerd, cloud-provider-aws, scorecard, hubble, grpcurl, bank-vaults, trino, spegel,...

CVE-2026-74244 Quay: stripe webhook accepts forged events without signature verification in quay

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

CVE-2026-19910

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...

CVE-2026-19910

CVE-2026-19910 affects PAX Technology Q80, specifically the Application Installer. The flaw is a signature verification bypass in the installer, allowing a network-adjacent attacker (no authentication, high attack complexity) to execute arbitrary code with root privileges by installing a signed-b...