Linux Distros Unpatched Vulnerability : CVE-2021-25634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since t...

PYSEC-2025-120

jupyterhub-ltiauthenticator is a JupyterHub authenticator for learning tools interoperability LTI. LTI13Authenticator that was introduced in jupyterhub-ltiauthenticator 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only use...

PYSEC-2025-120

jupyterhub-ltiauthenticator is a JupyterHub authenticator for learning tools interoperability LTI. LTI13Authenticator that was introduced in jupyterhub-ltiauthenticator 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only use...

CVE-2023-25574

CVE-2023-25574 concerns jupyterhub-ltiauthenticator’s LTI13Authenticator. The issue: LTI13Authenticator, added in version 1.3.0, did not validate JWT signatures, potentially allowing forged authentication requests when the JupyterHub instance is configured to use this authenticator. Affected depl...

AZL-57144 CVE-2025-27144 affecting package containerd2 for versions less than 2.0.0-6

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

AZL-57183 CVE-2025-27144 affecting package kubernetes for versions less than 1.28.4-15

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

Google Cloud KMS Adds Quantum-Safe Digital Signatures to Defend Against Future Threats

Google Cloud has announced quantum-safe digital signatures in Google Cloud Key Management Service Cloud KMS for software-based keys as a way to bulletproof encryption systems against the threat posed by cryptographically-relevant quantum computers. The feature, currently in preview, coexists with...

SUSE CVE-2025-1118

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory...

AZL-57025 CVE-2025-1118 affecting package grub2 for versions less than 2.06-25

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory...

AZL-56904 CVE-2025-1118 affecting package grub2 for versions less than 2.06-15

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory...

CVE-2025-1118

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory...

DEBIAN-CVE-2025-1118

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory...

UBUNTU-CVE-2025-1118

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory...

Atos Eviden IDRA 安全漏洞

Atos Eviden IDRA is an application from Atos France. A security vulnerability exists in Atos Eviden IDRA versions prior to 2.6.1, which stems from the presence of an incorrect access control vulnerability that allows an attacker to obtain CA signatures in an illegal manner...

PT-2025-7253 · Elliptic · Elliptic

Name of the Vulnerable Software and Affected Versions: elliptic affected versions not specified Description: The issue allows for private key extraction from ECDSA signatures when signing a malformed input, such as a string or a number, which could come from JSON network input. This is possible...

Q-Free MAXTIME Suite 安全漏洞

Q-Free MAXTIME Suite is a software suite for local traffic signal management from Q-Free. A security vulnerability exists in Q-Free MAXTIME Suite version 2.11.0 and prior versions, which stems from the use of hard-coded encryption keys in JWT signatures. An attacker could exploit the vulnerabilit...

PT-2025-6139 · Crates.Io · Hickory-Proto

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue concerns DNSSEC validation routines, which treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the...

PAM-PKCS#11 授权问题漏洞

PAM-PKCS11 is an OpenSC open source login module. An authorization issue vulnerability exists in PAM-PKCS11 versions prior to 0.6.13, which stems from not checking private key signatures in the default configuration, allowing an attacker to create a new token and log in with the user's public dat...

SUSE SLES15 Security Update : openssl-3 (SUSE-SU-2025:0388-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0388-1 advisory. - CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation bsc1236136. Tenable has extracted the preceding description block...

PT-2025-6140 · Crates.Io · Hickory-Proto

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue concerns DNSSEC validation routines, which treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the...