CVE-2022-21449

CVE-2022-21449 repo showcasing generation of a base64 signature for applications that are vulnerable to "psychic signatures in java", implemented in a nodejs environment 😅 Before running make sure to install the modified fork of elliptic from https://github.com/davwwwx/elliptic root@kitploit: $ n...

Digital-Signature-Forgery-Attack

En este artículo, analizaremos el ataque criptográfico de falsificación de firmas digitales Digital Signature Forgery Attack, cuyas consecuencias representan una amenaza para la seguridad de las transacciones en la red Bitcoin, ya que las firmas digitales confirman la propiedad y autorización de...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs

Summary IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-16177 DESCRIPTION: IBM DataPower Gateway could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read...

librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload

A flaw was found in Libreswan's implementation of IKEv1 authentication via raw RSA signatures. When processing an IKEv1 packet using PKCS 1 v1.5 RSA encryption, the RSAauthenticatehashsignaturerawrsa function fails to properly validate the length of the authentication hash. A remote,...

Johnny-You-Are-Fired

Johnny-You-Are-Fired Artifacts for the USENIX publication | Full paper here Abstract OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – SPHINCS+ WOTS+ Weak Randomness Signature Forgery Overview An implementation of the SPHINCS+ post‑quantum signature scheme uses a flawed random number generator during WOTS+ signature generation. The same nonce k is reused across multiple signatures, allowing an attacker to recove...

EUVD-2026-84946

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...

CVE-2026-18152

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...

CVE-2026-18152 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...

CVE-2026-0265-check

Herramienta de Evaluación de Vulnerabilidad CVE-2026-0265 Determine de manera segura si un portal GlobalProtect de Palo Alto Networks PAN-OS es vulnerable a CVE-2026-0265 sin autenticar ninguna sesión ni modificar ningún estado. Descripción CVE-2026-0265 es una omisión de autenticación remota que...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-054045)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054045 advisory. GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME ar...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-090063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090063 advisory. A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forge...

CVE-2026-42784

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

CVE-2026-42784 Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

EUVD-2026-80888

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

CVE-2026-42784

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

CVE-2026-42784: Improper Verification of Cryptographic Signature

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports digital signatures for ODF documents and macros within documents. It provides visual indicators that confirm that the document has not been altered since the last signature, and that the signature is valid. A vulnerability in certificate validation in LibreOffice allowed...

Astra Linux – Vulnerability in gnupg2

GnuPG versions up to 2.3.6 allow for signature forgery in unusual situations where an attacker possesses secret-key information from a victim’s keyring, and other constraints such as the use of GPGME are met. This can be achieved by injecting malicious data into the command line’s status line...

Astra Linux – Vulnerability in node-browserify-sign

“browserify-sign” is a package that duplicates the functionality of Node’s crypto public key functions. Much of this functionality is based on Fedor Indutny’s work on “indutny/tls.js”. There is a issue with upper-bound checking in the “dsaVerify” function, which allows an attacker to create...