4537 matches found
aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
SummaryWebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. SeverityHig...
PT-2026-69843
Name of the Vulnerable Software and Affected Versions libdigidocpp versions 4.1.0 through 4.2.0 DigiDoc4 versions 4.7.0 through 4.8.1 DigiDoc on Android versions 2.7.0 through 2.7.1 DigiDoc on iOS versions 2.8.0 through 2.8.0 Description Improper verification of cryptographic signature and improp...
CVE-2026-59112: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority RIA libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4:...
CVE-2026-16742
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user...
UBUNTU-CVE-2026-16742
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user...
npq v3.24.0
NPQ Documentation This directory contains comprehensive documentation for the NPQ Node Package Quality security auditing tool. Core Documentation optional-features.md Configuration and usage of optional security features, including recent improvements and bug fixes. age.marshall.md Detailed...
MAL-2026-13640 Malicious code in sme-rko-finance-front-operations-notifications-impl (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3461050b5714edca455c0fd78e979cd5efbdfeeb375016aeb4fe4523f47682 On require, index.js loads adapter.js which selects a platform-specific payload linux x64/arm64, darwin, win32 and fetches it from...
MAL-2026-13635 Malicious code in sme-rko-finance-front-operations-fee (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a2ef64871ebe6bf7dd675b3e686beec5a90dbaec72760b647e3c876674df9c5 The package's main entry ./lib/telemetry and its vendor.js module execute a binary dropper at require/import time. Hostnames and API identifiers are...
MAL-2026-13657 Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c551dcbca891aad241e275845a629ffe436abba6b8efdde650d6c117108d45 On require of the package, index.js loads bootstrap.js which downloads a platform-specific native binary from Cloudflare Workers subdomains assembled...
MAL-2026-13643 Malicious code in sme-rko-finance-front-operations-overnight (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled...
CVE-2026-58262
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS...
EUVD-2026-54712
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS...
OSEC-2026-14 RSA signature verification raises undocumented exception
The RSA decrypt and encrypt functions raise an Invalidargument exception if the message is smaller than 2. This leads to X509 certificates with a signature value of 0 or 1 to throw this Invalidargument exception instead of a proper error. Fix The fix is to reuse the Insufficientkey exception, whi...
MAL-2026-13565 Malicious code in dolyame-ui-datatable (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33 The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains...
MAL-2026-13582 Malicious code in dolyame-ui-inputsearch (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0146bdcb21ca52b35e8a6f3ca19b7203b1fb5a456eb9dff6ace2eb60348333fe [email protected] is a dropper disguised as a UI input search component. On require, index.js loads./vendor.js, which assembles a mirror...
Malicious code in dolyame-ui-scrollblock (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242ef9ba3c44f135b08ae34b89045c494ab2a94f3642eeb2a6e164e858561cb9 On require of the package, index.js loads helpers.js and lib/telemetry.js, which reassemble Cloudflare Workers hostnames from split string fragments...
MAL-2026-13598 Malicious code in dolyame-ui-selectaccount (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363 On require of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute...
CVE-2026-16030
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...
EUVD-2026-54385
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...