SUSE CVE-2026-118774

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

Linux Distros Unpatched Vulnerability : CVE-2026-118774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used...

Improper Verification of Cryptographic Signature

Overview org.webjars.npm:node-forge is a WebJar for node-forge. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the certificate.verify method in lib/x509.js. An attacker can relabel an existing PKCS1 v1.5 certificate as RSASSA-PSS and still...

CVE-2026-118774

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

AZL-112505 CVE-2026-118774 affecting package python-tensorboard 2.16.2-6

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

CVE-2026-118774

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

EUVD-2026-113331

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

CVE-2026-118774

The node-forge (or Forge) library, a JavaScript implementation of Transport Layer Security, contains a vulnerability in the certificate.verify(child) method within lib/x509.js. Prior to version 1.4.1 , the _verifySignature() function incorrectly selected RSA padding and RSASSA-PSS parameters from...

CVE-2026-118774 Forge: Certificate signature verified with the issuer's RSA signature scheme

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

CVE-2026-118774 Forge: Certificate signature verified with the issuer's RSA signature scheme

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

CVE-2026-118774

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

PT-2026-132788

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

DigitalBazaar Forge encryption issue vulnerability

Versions of DigitalBazaar Forge prior to 1.4.1 contain an encryption-related vulnerability. This vulnerability arises because in the processing of certificate.verifychild, verifySignature, and lib/x509.js, RSA padding and RSASSA-PSS parameters are selected from the issuer’s certificate rather tha...

CVE-2026-118774: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

Astra Linux – vulnerability in nss, Thunderbird

NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications utilizing NSS to process signatures encoded in CMS, S/MIME, PKCS \7, or PKCS \12 are likely to be affected. Applications that empl...

Siemens PSS(R)SINCAL

SUMMARY PSSRSINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle...

Rocky Linux 8 [CIQ] Security Update: nss / nss-debuginfo / nss-debugsource / nss-devel / nss-softokn / etc (crlsa-2021_4903)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214903 advisory. nss: Memory corruption in decodeECorDsaSignature with DSA signatures and RSA-PSS CVE-2021-43527 Tenable has extracted the preceding description block directly from...

Astra Linux – Vulnerability in Thunderbird

Thunderbird versions prior to 91.3.0 are vulnerable to a heap overflow vulnerability described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA ...

CVE-2026-52059

RSA-PSS CertificateVerify checks only 0xbc trailer...

CVE-2026-44938 Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a Fleet-monitored...