4543 matches found
PT-2026-78701
Name of the Vulnerable Software and Affected Versions mce-operator-bundle affected versions not specified Description The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning fixing a specific version of a commit or...
CVE-2026-50720
The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...
GO-2026-6246 uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set in gitlab.com/uniget-org/cli
uniget CLI: Metadata signature verification only runs when UNIGETIGNOREMETADATASIGNATURE is set in gitlab.com/uniget-org/cli...
CVE-2021-43716: Improper Verification of Cryptographic Signature
Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by encrypted firmware through USB...
PT-2026-80463
uniget CLI: Metadata signature verification only runs when UNIGET IGNORE METADATA SIGNATURE is set in gitlab.com/uniget-org/cli...
uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set
Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...
PYSEC-2026-3756
opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...
EUVD-2026-60095
opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...
PT-2026-76612
openssl encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from dict that creates key bundles from untrusted data without verifying signatures. Attackers can call from dict followed by to identity without signature verification to encrypt data using attacker-controlled publi...
ROS-20260817-73-0218
The vulnerability of the command-line tool openssl dgst from the OpenSSL library is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker to influence the integrity of the protected information...
Unity Linux 20.1070a Security Update: compat-openssl10 (UTSA-2026-099546)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099546 advisory. Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact summary: A use-after-fre...
Exploit for CVE-2026-9090
CVE-2026-9090 — Casdoor SAML Signature Bypass PoC Proof-of-...
CVE-2026-24882 vulnerabilities
Vulnerabilities for packages: gnupg...
GHSA-25MV-J2QR-V5JQ vulnerabilities
Vulnerabilities for packages: tekton-chains, cloud-provider-vsphere, kserve, docker-credential-acr-env, gobuster, argo-rollouts, buf, go-licenses, slsa-verifier, gcp-compute-persistent-disk-csi-driver, mcp-grafana, certificate-transparency, kubernetes-csi-external-snapshotter, sbomqs, kine,...
CVE-2026-74244 Quay: stripe webhook accepts forged events without signature verification in quay
A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...
CVE-2026-19910
PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...
EUVD-2026-58802
PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...
CVE-2026-19910
CVE-2026-19910 affects PAX Technology Q80, specifically the Application Installer. The flaw is a signature verification bypass in the installer, allowing a network-adjacent attacker (no authentication, high attack complexity) to execute arbitrary code with root privileges by installing a signed-b...
