6847 matches found
CVE-2026-85393
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...
AZL-99750 CVE-2026-85393 affecting package python-tensorboard 2.16.2-6
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...
CVE-2026-85394
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
UBUNTU-CVE-2026-85394
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
CVE-2026-85394
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
UBUNTU-CVE-2026-85393
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...
CVE-2026-85393
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...
EUVD-2026-70671
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
CVE-2026-85394 python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
CVE-2026-85394 python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
CVE-2026-85393
node-forge through 1.4.0 has a cryptographic vulnerability in its RSA PKCS#1 v1.5 signature verification . The library fails to validate the element count in nested DigestAlgorithm sequences, allowing an attacker to embed garbage bytes inside that sequence to forge valid signatures for arbitrary ...
CVE-2026-85393 node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...
EUVD-2026-70670
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...
CVE-2026-85388 Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...
CVE-2026-85388
Worklenz through 3.0.0 is vulnerable to blind SQL injection via the sort-field query parameter in pagination helper functions. The root cause is improper validation that allows authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can leverage time-based ...
MINI-98F7-8J8G-7FR8
Bulletin has no description...
MINI-J39H-9267-2RWM
Bulletin has no description...
MINI-64CR-G98P-QJ8J
Bulletin has no description...