7236 matches found
CVE-2026-85394 python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
CVE-2026-85394 python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
CVE-2026-85394
python-jose through version 3.5.0 contains an algorithm confusion vulnerability in its HMAC key validation logic. The library fails to properly reject DER-encoded public keys that lack PEM armor or SSH prefixes, allowing them to be accepted as HMAC secrets. An attacker who possesses the service's...
CVE-2026-85394 python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
Updated perl-Net-OAuth packages fix security vulnerabilities
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smartrequire Net::OAuth versions before 0.3...
American Fuzzy Lop plus plus 5.03c
Google's American Fuzzy Lop is a brute-force fuzzer coupled with an exceedingly simple but rock-solid instrumentation-guided genetic algorithm. afl++ is a superior fork to Google's afl. It has more speed, more and better mutations, more and better instrumentation, custom module support, etc...
PT-2026-90709
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get request token Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart require Net::OAuth versions before...
CVE-2020-7494
creationtimestamp| type| source ---|---|--- 2026-09-01 17:01:12+00:00| seen| https://t.me/cissp/1528 2026-09-02 01:05:01+00:00| seen| https://t.me/cissp/1528 2026-09-12 01:00:05+00:00| published-proof-of-concept| https://t.me/cissp/1528 2026-09-13 00:01:01+00:00| published-proof-of-concept|...
CVE-2026-83614
A flaw was found in xmldom. Two independent quadratic paths in the XML DOM Document Object Model parser can lead to a denial of service DoS. A remote attacker could exploit this by providing specially crafted XML input, causing the parser to repeatedly rescan malformed tag names or reindex and...
Security update for python3-sqlparse
This update for python3-sqlparse fixes the following issues: CVE-2026-54284: high algorithm complexity when parsing SQL payloads with hundreds of nesting levels can lead to denial of service via excessive resource consumption bsc1275459. CVE-2026-59893: quadratic complexity when processing...
Security Bulletin: IBM i is Affected By Cryptographic Algorithm Weakness in DCM [CVE-2026-16693]
Summary IBM i is vulnerable to allowing an authenticated attacker to obtain sensitive information CVE-2026-16693 in Digital Certificate Manager DCM as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16693 DESCRIPTION: IBM i could allow a remote authenticated...
CVE-2026-76133
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate...
EUVD-2026-68612
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate...
CVE-2026-76133: Use of a Broken or Risky Cryptographic Algorithm
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate...
OPENSUSE-SU-2026:21690-1 Security update for python-sqlparse
This update for python-sqlparse fixes the following issues: - CVE-2026-54284: high algorithm complexity when parsing SQL payloads with hundreds of nesting levels can lead to denial of service via excessive resource consumption bsc1275459. - CVE-2026-59893: quadratic complexity when processing...
CVE-2026-82454
CVE-2026-82454 is a CRITICAL authentication bypass in the Omnivore API (packages/api), affecting versions before android-0.227.0 . The decodeAppleToken function extracted the alg field from an attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Because jsonwe...
CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...