18903 matches found
CVE-2026-76272
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user i...
EUVD-2026-94624
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user i...
GHSA-7C92-X8VG-4258 PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...
EUVD-2026-44642
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents...
EUVD-2026-43177
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing...
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Summary PraisonAI's AgentMail bot, when run in webhook or hybrid mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the...
GHSA-QJ9C-59P6-8CGX PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Summary PraisonAI's AgentMail bot, when run in webhook or hybrid mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the...
CVE-2026-106457
A flaw was found in the Backstage Cloudflare Access authentication provider module. This vulnerability allows an attacker to gain unauthorized access to the Backstage application. The provider verifies a token's signature and team issuer but fails to confirm that the token was issued for the...
sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...
sub2api-easypay-poc
sub2api-easypay-poc Sub2API Wei-Shaw/sub2apihttps://git...
CVE-2026-16516 wolfSSH ECDSA host key curve not validated against negotiated algorithm
wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...
CVE-2026-16516 wolfSSH ECDSA host key curve not validated against negotiated algorithm
wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...
PT-2026-107694
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Splunk Secure Gateway versions prior to 3.10.11 Splunk Secure Gateway...
PT-2026-107649
Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.128 through 4.6.62 Description The AgentMail webhook mode in praisonai exposes a public aiohttp endpoint that accepts message.received JSON payloads without verifying Svix webhook signatures. This allows an attacker to...
CVE-2026-76482: Improper Verification of Cryptographic Signature
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...
sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...
sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...
bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...
bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...
bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...