CVE-2026-0392

eParakstītājs 3.0 for Windows prior to 1.10.0 is vulnerable: its auto-update uses an unauthenticated/integrity-free channel. The client fetches an XML update descriptor over TLS while accepting any certificate, with no verification of the descriptor’s digital signature, no Authenticode/signature ...

CVE-2026-0392 eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor XML over TLS but accepts any TLS certificate a permissive TrustManager and ...

Beyond Perimeter Defense: Implementing Zero Trust in Federal Agencies

Learn how to address cybersecurity in this new perimeter-less world and get six steps to achieving Least Permissive Trust for federal agencies...

GO-2024-2472 Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry

Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry...

Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry

Impact An external actor with control of a compromised container registry can provide outdated versions of OCI artifacts, such as Images. This could lead artifact consumers with relaxed trust policies such as permissive instead of strict to potentially use artifacts with signatures that are no...