CVE-2026-125335

A flaw was found in node-forge. The library's digital signature verification does not properly reject weak or invalid public keys when validating Ed25519 signatures. A remote attacker who can provide an untrusted public key can exploit this issue to create signatures that appear valid for arbitra...

CVE-2025-0008: AMD: Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU),…

Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock SDU, potentially resulting in unauthorized debug access...

CVE-2026-118791

The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification...

CVE-2026-118462

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution...

CVE-2026-118791

The CompuGroup Medical Wingesfar application is vulnerable to an insecure software update mechanism (CVE-2026-118791 ). The software update functionality lacks adequate authenticity and integrity validation , which allows the application to accept update packages without sufficient cryptographic ...

CVE-2026-118791 Insecure software update mechanism

The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification...

EUVD-2026-120030

The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification...

EUVD-2026-120024

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution...

CVE-2026-118462

Products by CompuGroup Medical are affected by CVE-2026-118462 , which involves an update mechanism that downloads and executes code without proper authenticity verification . The root cause is the reliance on ignored hashes or forgeable checksums , allowing for unauthorized code execution. Addit...

CVE-2026-118791: CompuGroup Medical Wingesfar: The application implements software update functionality without adequate authenticity and integrity validation,…

The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification...

PT-2026-140388

The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification...

CVE-2026-118462: CompuGroup Medical: Update components download and execute code without proper authenticity verification, relying on ignored hashes or…

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution...

PT-2026-140381

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution...

CVE-2026-118377: mewebstudio pos: mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows…

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

Insufficient Verification of Data Authenticity

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via a forged client-supplied uuid field in multimodal content parts, which vLLM uses verbatim as the...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via ownerisstale in src/filelock/soft.py and src/filelock/identity.py, when a process owner identity comparison is performed between a lock holder whose start token was recorded without a...

CVE-2026-112265

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receivev1 or card.action.trigger events to drive th...

CVE-2026-112265 LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receivev1 or card.action.trigger events to drive th...

CVE-2026-112265

LangBot versions through 4.11.0 are vulnerable to a missing authenticity verification flaw in the Lark/Feishu webhook handling. The root cause is a failure to perform proper signature checks, allowing unauthenticated attackers who know a bot UUID to inject forged im.message.receive_v1 or card.act...

CVE-2026-112265

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receivev1 or card.action.trigger events to drive th...