CVE-2026-112265

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receivev1 or card.action.trigger events to drive th...

EUVD-2026-104308

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receivev1 or card.action.trigger events to drive th...

CVE-2026-112265 LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receivev1 or card.action.trigger events to drive th...

CVE-2026-112265

LangBot versions through 4.11.0 are vulnerable to a missing authenticity verification flaw in the Lark/Feishu webhook handling. The root cause is a failure to perform proper signature checks, allowing unauthenticated attackers who know a bot UUID to inject forged im.message.receive_v1 or card.act...

EUVD-2026-102310

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-102695

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

CVE-2026-102695

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

CVE-2026-102695 OmniFaces: Forged combined-resource IDs and related output/push boundaries

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

EUVD-2026-101293

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

CVE-2026-83787

The Windows DHCP Server is affected by a vulnerability involving insufficient verification of data authenticity . This flaw allows an authorized attacker to perform a local security feature bypass . The vulnerability is associated with CWE-288 (Authentication Bypass Using an Alternate Path or Cha...

CVE-2026-83787: Authentication Bypass Using an Alternate Path or Channel

Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally...

EUVD-2026-97202

Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications...

CVE-2026-21138

Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications...

CVE-2026-108568

The InstantSoft icms2 software (versions up to 2.18.2 ) contains a vulnerability in the Billing Module specifically within the validatePaypalOrder function located in the file system/controllers/billing/actions/paypal.php. An attacker can remotely manipulate the bid/sig arguments to cause insuffi...

CVE-2026-108568 InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient...

CVE-2026-13257 IBM DataPower Gateway Insufficient Verification of Data Authenticity

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity...

CVE-2026-13257: Insufficient Verification of Data Authenticity

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity...

Apple’s Verified Photography System

Apple just released a system called "Reference Image." It can verify the image is exactly as taken by an iPhone--new models only--without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other industry solutions require a photograph...

CVE-2026-107284: Insufficient Verification of Data Authenticity

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installati...

Containerd Code Execution

The vulnerability of the Containerd process for importing the CRI of the runtime environment is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...