EUVD-2026-109983

zip: AES Entry HMAC Authentication Bypass on Premature EOF...

SUSE CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

Linux Distros Unpatched Vulnerability : CVE-2026-115906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC...

CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

AZL-112217 CVE-2026-115906 affecting package rust 1.96.1-2

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

DEBIAN-CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

PT-2026-123429

Name of the Vulnerable Software and Affected Versions zip versions 0.6.0 through 8.9.9 Description The AES entry reader in src/aes.rs verifies its HMAC Hash-based Message Authentication Code, a mechanism for verifying both the data integrity and the authenticity of a message only when the...

USN-8916-2 pyjwt vulnerabilities

USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the corresponding fix for PyJWT on Ubuntu 26.10. Original advisory details: YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to...

USN-8916-2: PyJWT vulnerabilities

USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the corresponding fix for PyJWT on Ubuntu 26.10. Original advisory details: YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : PyJWT vulnerabilities (USN-8916-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8916-1 advisory. YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC...

USN-8916-1: PyJWT vulnerabilities

YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to forge authentication tokens. This issue only affected Ubuntu 26.04 LTS. CVE-2026-102266 Rohan Das discovered that PyJWT incorrectly handled...

USN-8916-1 pyjwt vulnerabilities

YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to forge authentication tokens. This issue only affected Ubuntu 26.04 LTS. CVE-2026-102266 Rohan Das discovered that PyJWT incorrectly handled...

SUSE CVE-2026-90333

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

PT-2026-94681

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm-integrity component where the dm integrity rw tag function treats a stored tag consisting of all 0xf6 bytes DISCARD FILLER as evidence that a block was discarde...

CVE-2026-90333: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

CVE-2026-90333: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

CVE-2026-57122

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

CVE-2026-57122 PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...