PT-2026-104644

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...

CVE-2026-105161: Improper Verification of Cryptographic Signature

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accept...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a...

Security Bulletin: Vulnerability in golang.org/x/mod bundled with IBM Fusion and IBM Fusion HCI

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the golang.org/x/mod library, which is affected by multiple vulnerabilities, including Improper verification of cryptographic signatures and integrity verification bypass. CVE-2026-56864, CVE-2026-56865. Vulnerability...

CVE-2026-63571

Improper verification of cryptographic signature in the attribute certificate path validator PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as...

CVE-2026-63571: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in the attribute certificate path validator PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as...

PT-2026-104130

Improper verification of cryptographic signature in the attribute certificate path validator PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as...

CVE-2026-94212

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

EUVD-2026-90765

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

CVE-2026-94212

Apache APISIX versions 3.17.0 through 3.18.0 are vulnerable to an improper verification of cryptographic signature flaw within the saml-auth plugin. Under default configurations, an unauthenticated attacker can exploit this to impersonate any user across every route protected by the plugin. To re...

PT-2026-103831

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.17.0 through 3.18.0 Description An improper verification of cryptographic signatures occurs within the saml-auth plugin under default configuration. This allows an unauthenticated attacker to impersonate any user on...

CVE-2026-94212: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

CVE-2026-103245: Improper Verification of Cryptographic Signature

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...