CVE-2026-87802 Apache Syncope: SRA OAuth2 JWT signature verification bypass

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA. This issue...

CVE-2026-25832

A flaw was found in Mbed TLS. The Transport Layer Security TLS 1.3 client accepts a HelloRetryRequest that selects a cryptographic group not advertised by the client. This vulnerability could allow a remote attacker to cause a low integrity impact. Mitigation Mitigation for this issue is either n...

CVE-2026-54155: Improper Verification of Cryptographic Signature

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcuaserver.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session...

CVE-2026-87802: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA. This issue...

PT-2026-91595

A cryptographic issue was addressed with improved integrity checks. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An attacker in a privileged network position may be able to modify network traffic...

CVE-2026-90510 dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

CVE-2026-90510

dromara orion-visor (up to version 2.5.7) contains a hard-coded AES cryptographic key in the HostKeyServiceImpl.encryptKey function within the asset-service module. This CWE-321 flaw allows a remote attacker, with no privileges or user interaction, to decrypt SSH private keys and host passwords s...

CVE-2026-90510 dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

CVE-2026-90510: Use of Hard-coded Cryptographic Key

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

libsignal v0.102.2

Overview libsignal contains platform-agnostic APIs used by the official Signal clients and servers, exposed as a Java, Swift, or TypeScript library. The underlying implementations are written in Rust: libsignal-protocol: Implements the Signal protocol, including the Double Ratchet algorithm. A...

CVE-2026-89172

Microchip AN1044, AN953, and SW300052 cryptographic algorithms are subject to an improper protection of physical side channels vulnerability. Affected versions: AN1044 through A, AN953 through A, and SW300052 through 2.6. The attack requires physical access with high complexity and specific attac...

CVE-2026-89172 Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms

Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6...

CVE-2026-89172 Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms

Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6...

Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities

Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.1...

CVE-2026-73784: Improper Verification of Cryptographic Signature

A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user...

CLEANSTART-2026-IL11339 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers

Multiple security vulnerabilities affect the az package. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. See references for individual vulnerability details...

[SECURITY] Fedora 43 Update: openssl-3.5.8-1.fc43

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols...

CVE-2026-89086: Improper Verification of Cryptographic Signature

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS 1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key...

CVE-2026-89042: Improper Verification of Cryptographic Signature

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

DRUPAL-CONTRIB-2026-144

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module uses cryptographic constructions that do not align with current security best practices. The module performs certain signature...