Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2022_6159)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226159 advisory. curl: HTTP compression denial of service CVE-2022-32206 curl: FTP-KRB bad message verification CVE-2022-32208 Tenable has extracted the preceding descripti...

CVE-2026-101277

A flaw was found in OpenDKIM. A remote attacker can exploit this vulnerability by sending manipulated email authentication tags to the tag tokenizer, specifically affecting the dkimprocessset function. This flaw causes the application to rely on a less trusted source during processing, potentiall...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the PKMACValueVerifier.isValid and ProtectedPKIMessage.verify verification paths, where PKMACBuilder's default constructor leaves maxIterations = 0 and disables the iteration-count...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the PKMACValueVerifier.isValid and ProtectedPKIMessage.verify verification paths, where PKMACBuilder's default constructor leaves maxIterations = 0 and disables the iteration-count...

CVE-2026-15206 SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass

Summary ExAws.SNS.verifymessage/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that its host is an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to any endpoint that calls...

EUVD-2026-18166

SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allowing an attacker to control trusted headers...

CVE-2025-41722

The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices...

CVE-2025-41722

CVE-2025-41722 : The set of connected sources confirms a vulnerability in the wsc server where a hard-coded certificate is used to verify SOAP messages. This configuration enables an unauthenticated remote attacker to extract private keys from the affected devices. The issue is tied to multiple a...

EUVD-2012-6384

Malware in sbrugna...

EUVD-2020-30059

Malware in sbrugna...

EUVD-2023-58565

Malicious code in bioql PyPI...

EUVD-2024-3291

Malicious code in bioql PyPI...

Accountable, Scalable and DoS-Resilient Secure Vehicular Communication

Paramount to vehicle safety, broadcasted Cooperative Awareness Messages CAMs and Decentralized Environmental Notification Messages DENMs are pseudonymously authenticated for security and privacy protection, with each node needing to have all incoming messages validated within an expiration...

CVE-2024-51518

Vulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2005-2145

The kernel driver in Prevx Pro 2005 1.0 does not verify the source of certain messages, which allows local users to bypass protection by sending certain messages to the driver, as demonstrated by sending an "allow" message to bypass a warning message...

CVE-2025-47934

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified message can be passed to either openpgp.verify or openpgp.decrypt, causing these functions to return a valid signature verification result...

CVE-2025-47934

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified message can be passed to either openpgp.verify or openpgp.decrypt, causing these functions to return a valid signature verification result...

bind: Fix of CVE-2024-1975

CVE-2024-1975: Remove support for SIG0 message verification - Fix tsiggss test...

CVE-2023-42571

Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the Samsung Account password with SMS verification when user lost the device...