EUVD-2026-63578

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an...

CVE-2026-77151 lin-snow Ech0 crypto.go MD5Encrypt risky encryption

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an...

CVE-2026-72889

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...

EUVD-2026-62347

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...

CVE-2026-72889

Net::OAuth (Perl module) versions before 0.33 are vulnerable to signature algorithm confusion in the verify method. The verifying party cannot pin the signature algorithm; it is chosen by the sender via the signature_method parameter. When a provider is deployed with RSA-SHA1 (which per RFC 5849 ...

CVE-2026-72889 Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...

CVE-2026-72889 Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...

CVE-2026-72889

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...

Linux Distros Unpatched Vulnerability : CVE-2026-72889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the...

CVE-2026-55165

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165

In Lemur 1.9.0 and earlier, lemur/auth/service.py:130-137 reads the alg field from an unverified JWT header and passes it to pyjwt.decode(..., algorithms=[header_data["alg"]]), letting an attacker choose the verification algorithm. PyJWT 2.x blocks alg=none, so direct ATO requires a separate LEMU...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

The vulnerability of the Apache Tomcat application server, related to the use of cryptographic algorithms containing vulnerabilities, allows attackers to alter the order of preference for encryption.

The vulnerability of the Apache Tomcat application server is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability allows a remote attacker to alter the encryption preferences...

CVE-2026-27871 TL280

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63...

CVE-2026-27871

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63...

CVE-2026-73652

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can chan...

CVE-2026-72663

CVE-2026-72663 concerns Kibana with an inefficient algorithmic complexity (CWE-407) in TSVB visualizations that can cause denial of service. A specially crafted, deeply nested expression evaluated in a TSVB visualization may trigger worst-case behavior that ties up a Kibana request thread, making...

CVE-2026-72685

CVE-2026-72685 describes an inefficient algorithmic complexity in Elasticsearch that allows a low-privileged authenticated user, who can index documents, to submit a small crafted document causing a worker thread to be consumed for an extended period, degrading indexing availability. Affected ver...

CVE-2026-73652 vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can chan...