OESA-2025-2490 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read an...

CVE-2025-11899 Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic Key

Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first obtain an user ID in order to exploit...

EUVD-2025-34859

Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first obtain an user ID in order to exploit...

Fortinet FortiClient MacOS installer data forgery issue vulnerability

Fortinet FortiClient MacOS installer is a client installer from Fortinet. The Fortinet FortiClient MacOS installer suffers from a data forgery issue vulnerability that stems from improper cryptographic signature validation, which can be exploited by an attacker to cause elevation of privilege for...

CVE-2025-11899: Use of Hard-coded Cryptographic Key

Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first obtain an user ID in order to exploit...

CVE-2025-58426

desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications...

CVE-2025-58426

desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications...

CVE-2025-58426

desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications...

CVE-2025-58426: Use of Hard-coded Cryptographic Key

desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications...

PT-2025-42458

Name of the Vulnerable Software and Affected Versions desknet's NEO versions 4.0R1.0 through 9.0R2.0 Description desknet's NEO contains a hard-coded cryptographic key. This allows an attacker to create malicious AppSuite applications. Recommendations Update to a version later than 9.0R2.0...

CVE-2025-59288

Improper verification of cryptographic signature in GitHub allows an unauthorized attacker to perform spoofing over an adjacent network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising eas...

CVE-2025-58720

Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally...

CVE-2025-46774

An Improper Verification of Cryptographic Signature vulnerability CWE-347 in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to escalate their privileges via FortiClient related executables...

Improper Verification of Cryptographic Signature

Overview org.apache.spark:spark-network-common2.12 is an open-source distributed general-purpose cluster-computing framework. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature when the spark.network.crypto.enabled is true and the cipher is not...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature when the spark.network.crypto.enabled is true and the cipher is not explicitly configured, resulting in the use of AES in CTR mode without authentication. An attacker can compromise the...

CVE-2025-55039: Improper Verification of Cryptographic Signature

This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true it is set to false by default, but...

PT-2025-43984

Name of the Vulnerable Software and Affected Versions D-Link DAP-2695 version 2.00RC13 Description A weakness exists in the cryptographic signature verification process within the Firmware Update Handler component, specifically in the sub 40C6B8 function. This allows for manipulation, potentially...

EUVD-2025-34363

Improper verification of cryptographic signature in GitHub allows an unauthorized attacker to perform spoofing over an adjacent network...

EUVD-2025-34319

Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally...

Improper Verification of Cryptographic Signature

Overview playwright-core is an A high-level API to automate web browsers Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via improper verification of cryptographic signatures during package installation. An attacker can impersonate trusted...