in-toto

in-toto in-toto は、ソフトウェアサプライチェーンの整合性を保護するためのフレームワークを提供します。チェーン内の各タスクが計画どおりに、権限のある担当者のみによって実行され、製品が転送中に改ざんされないことを検証することで、これを実現します。 in-toto では、プロジェクトオーナー が レイアウト（layout） を作成する必要があります。レイアウトには、ソフトウェアサプライチェーンの ステップ（step） の順序と、これらのステップを実行する権限を持つ 実行担当者（functionary） が一覧表示されます。 実行担当者がステップを実行すると、in-toto...

ICPin

ICPin インテグリティチェック監視用Pintool 概要 メモリ内の実行可能ファイルへの読み書きを記録するPintoolです。また、 動的に実行されたコードを追跡し、いくつかのアンチデバッグチェックを処理します（ Pintoolの設計上、ほとんどのアンチデバッグの影響を受けません）。さらに、監視対象の 動作のバックトレースを出力します。 使い方 ビルド MSCV版を https://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads からダウンロード Visual...

CVE-2026-3502---TrueConf-Client-Update-Hijacking-PoC

🔓 CVE-2026-3502 - TrueConf クライアント更新ハイジャックエクスプロイト ⚠️ 警告 このツールは教育目的および許可されたテスト専用です。明示的な許可なくシステムで使用しないでください。 📋 説明 CVE-2026-3502 のエクスプロイト - TrueConf クライアント（Windows）における整合性検証なしの更新脆弱性。ローカルの TrueConf サーバーを制御する攻撃者が、正規の更新パッケージを悪意のあるものに置き換え、接続中のすべてのクライアントでリモートコード実行を達成できます。 🎯 影響 更新コンテキストでの任意のコード実行 （昇格された権限）...

CVE-2026-76144

The Genian SSL PNS software is susceptible to an unrestricted file upload vulnerability. This issue stems from insufficient file extension and integrity verification , which enables an attacker to upload dangerous files to the system. No specific exploit information or remediation details are pro...

EUVD-2026-80055

Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtdwrite allowing forged firmware authenticity checks. Attackers can exploit putfile.cgi and checkimageuuid.c to bypass firmware signature validation and load unauthorized firmware images...

CVE-2026-76852

Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtdwrite allowing forged firmware authenticity checks. Attackers can exploit putfile.cgi and checkimageuuid.c to bypass firmware signature validation and load unauthorized firmware images...

CVE-2026-76852

Netcore NR268 firmware version 1.7.121109 is affected by an improper integrity verification flaw in mtd_write that allows forged firmware authenticity checks. Attackers with network access and low privileges can exploit put_file.cgi and check_image_uuid.c to bypass firmware signature validation a...

CVE-2026-76852 Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write

Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtdwrite allowing forged firmware authenticity checks. Attackers can exploit putfile.cgi and checkimageuuid.c to bypass firmware signature validation and load unauthorized firmware images...

CVE-2026-76852 Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write

Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtdwrite allowing forged firmware authenticity checks. Attackers can exploit putfile.cgi and checkimageuuid.c to bypass firmware signature validation and load unauthorized firmware images...

PT-2026-93186

Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtd write allowing forged firmware authenticity checks. Attackers can exploit put file.cgi and check image uuid.c to bypass firmware signature validation and load unauthorized firmware images...

CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-87063

A flaw was found in konflux-operator-tasks. The Continuous Integration CI process installs the tkn command-line interface CLI from a network download without verifying its integrity through checksums or digital signatures. This vulnerability could allow a compromised distribution channel to...

NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replacetmpfilepath, filepath moves it to the final location line 799 3. Extraction begins vi...

GHSA-5WP5-5229-5G6Q NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replacetmpfilepath, filepath moves it to the final location line 799 3. Extraction begins vi...

CVE-2026-62654

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This...

CVE-2026-78574: Untrusted Search Path

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

CVE-2026-25250 — Updated!

🕷️ CVE-2026-25250: Improper Trusted Bootloader Chain Validation A Microsoft-signed third-party bootloader that loads a secondary EFI binary with no signature or integrity verification, collapsing the Secure Boot chain of trust from within. 📑 Table of Contents Research Context Official References...

CVE-2026-63310

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation. Mitigation Upgrade the nltk...

PYSEC-2026-3779

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...