CVE-2026-4258

Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH...

SUSE CVE-2026-28498

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect OIDC ID Tokens. Specifically, the internal hash verification logic verifyhash...

SUSE CVE-2026-32627

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and setfollowlocationtrue, any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new...

sjcl 安全漏洞

sjcl is a deprecated JavaScript encryption library developed by bitwiseshiftleft. Sjcl has a security vulnerability, which stems from the lack of point-to-point verification in sjcl.ecc.basicKey.publicKey. This vulnerability could allow attackers to recover the victim’s ECDH private key by sendin...

The vulnerability of PDF viewing and editing programs such as Acrobat DC and Acrobat Reader DC, particularly in versions like Acrobat 2024, stems from errors in verifying cryptographic signatures. This allows attackers to exploit these vulnerabilities to gain increased privileges.

The vulnerabilities of PDF viewing and editing programs such as Acrobat DC, Acrobat Reader DC, and Acrobat 2024 are related to errors in verifying the cryptographic signature. Exploiting these vulnerabilities can allow attackers to enhance their privileges...

PT-2026-25915

The GL-iNet Comet GL-RM1 KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the...

GL-iNet Comet 安全漏洞

GL-iNet Comet is a portable, multi-functional network device developed by GL-iNet Corporation in China. There is a security vulnerability in GL-iNet Comet, which stems from the lack of certificate verification during the initialization process when connecting to the GL-iNet site. This vulnerabili...

Fedora 45 : cpp-httplib (2026-06d1b46d1e)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-06d1b46d1e advisory. Automatic update for cpp-httplib-0.38.0-1.fc45. Changelog Tue Mar 17 2026 Petr Menk - 0.38.0-1 - Update to 0.38.0 rhbz2447261 Tue Mar 17 2026 Petr Menk -...

JetKVM 安全漏洞

JetKVM is an open-source remote computer management tool developed by JetKVM. Versions of JetKVM prior to 0.5.4 contained security vulnerabilities. These vulnerabilities stemmed from the lack of verification of the authenticity of downloaded firmware files. This could allow intermediate parties o...

GL-iNet Comet 安全漏洞

GL-iNet Comet is a portable, multi-functional network device developed by GL-iNet Corporation in China. There is a security vulnerability present in GL-iNet Comet, which stems from insufficient verification of the authenticity of uploaded firmware files. This vulnerability may allow intermediate...

HCL Sametime 安全漏洞

HCL Sametime is a conference solution developed by the Indian company HCL. HCL Sametime has a security vulnerability, which stems from incomplete server-side verification. This vulnerability could allow attackers to bypass client input checks by sending manipulated HTTP requests directly to the...

PT-2026-25912

@securityweekly @anton chuvakin Good research. But about CVE-2026-32290 – GL-iNet Comet KVM insufficient verification of firmware authenticity… isn’t it the whole point of these devices that you could just run your own firmware opensource on it also? Like openwrt...

PT-2026-25954

CVE-2026-3856 IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integ… https://t.co/3y33wLJj0n...

PT-2026-26148

Name of the Vulnerable Software and Affected Versions Sliver versions 1.7.3 and below Description Sliver is a command and control framework that utilizes a custom Wireguard network stack. Versions 1.7.3 and below contain a Remote Out-of-Memory OOM issue in the mTLS and WireGuard C2 transport laye...

A Longitudinal Study of Usability in Identity-Based Software Signing

Identity-based software signing tools aim to make software artifact provenance verifiable while reducing the operational burden of long-lived key management. However, there is limited cross-tool longitudinal evidence about which usability problems arise in practice and how those problems evolve a...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2026-1602)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-25873

Name of the Vulnerable Software and Affected Versions sjcl affected versions not specified Description The software is susceptible to an Improper Verification of Cryptographic Signature issue due to missing point-on-curve validation within the sjcl.ecc.basicKey.publicKey function. An attacker can...

Improper Verification of Cryptographic Signature

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the JsonWebSignature.preparealgorithmkey method in authlib/jose/rfc7515/jws.py. An attacker can bypass authenticatio...

CVE-2026-27962

A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK JSON Web Key Header Injection, affects how Authlib verifies digital signatures in JWS JSON Web Signature tokens. An attacker can exploit this by creati...

CVE-2026-4269

A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. This issue only affects users of the Bedrock AgentCore Starter Toolkit before...