CVE-2026-109399

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can emb...

UBUNTU-CVE-2026-109399

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can emb...

CVE-2026-109399

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can emb...

CVE-2026-109399

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can emb...

CVE-2026-109399 SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can emb...

EUVD-2026-97496

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can emb...

CVE-2026-109399

The SWUpdate software (versions through 2026.05.1 ) is vulnerable to a CMS Signature Verification Bypass due to an improper certificate validation flaw in crypto/swupdate_cms_verify_openssl.c. The root cause is that the system trusts untrusted X.509 certificates embedded within CMS SignedData dur...

CVE-2026-109399 SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can emb...

CVE-2026-109399: Improper Certificate Validation

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can emb...

PT-2026-110628

Name of the Vulnerable Software and Affected Versions SWUpdate versions prior to 2026.05.2 Description An improper certificate validation issue exists in the crypto/swupdate cms verify openssl.c file. The system trusts untrusted X.509 certificates embedded in CMS SignedData during the chain...

CVE-2026-100613

The capgo.app OTA update platform for Capacitor apps is vulnerable in all versions up to the current release. The transfer_app() database function fails to delete or revalidate records in channel_permission_overrides during an organization transfer. This allows a former member of a source organiz...

About Remote Code Execution - ViPNet Client (BDU:2026-09885) vulnerability

About Remote Code Execution - ViPNet Client BDU:2026-09885 vulnerability. The ViPNet Client software suite is designed to protect corporate users' workstations by providing secure data exchange over IP networks, controlling the network activity of applications and operating system components, and...

PT-2026-54628

Name of the Vulnerable Software and Affected Versions Open VSX Registry versions prior to 1.0.2 Description The '/vscode/unpkg/' endpoint serves user-supplied HTML files with a text/html Content-Type and lacks a Content-Security-Policy or Content-Disposition: attachment response header. This allo...

CVE-2026-10735

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

CVE-2026-10735

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

EUVD-2026-38693

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning

Prior research suggests that differential privacy DP inherently enhances the robustness of federated learning FL against backdoor attacks. In this paper, we challenge this assumption. Through an empirical analysis of two baseline attack strategies, we uncover a fundamental tension in DP-FL: while...

CVE-2026-42251 Hard-coded credentials in KS-SOMED

Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a...

CVE-2025-9497

Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0...

Microchip Time Provider 4100 security vulnerability

Microchip Time Provider 4100 is a precision time gateway developed by the American company Microchip. Versions of Microchip Time Provider 4100 prior to version 2.5.0 contained security vulnerabilities. These vulnerabilities stemmed from the use of hard-coded credentials, which could lead to...