EUVD-2026-60095

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

DataEase v2.10.2 - JWT Signature Verification Bypass

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions, the lack of signature verification of JWT tokens allows attackers to forge JWTs, which then allow access to any interface. The...

CVE-2026-24882 vulnerabilities

Vulnerabilities for packages: gnupg...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: terragrunt, pgpool2exporter, kine, aws-nuke, nri-haproxy, cloud-provider-vsphere, contour, kubernetes-csi-external-resizer, osv-scanner, crossplane-provider-aws-ec2, ip-masq-agent, lvm-driver, docker-credential-ecr-login, amass, wave, kubernetes-csi-driver-hostpath,...

CVE-2026-74244 Quay: stripe webhook accepts forged events without signature verification in quay

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

CVE-2026-19910

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...

CVE-2026-19910

CVE-2026-19910 affects PAX Technology Q80, specifically the Application Installer. The flaw is a signature verification bypass in the installer, allowing a network-adjacent attacker (no authentication, high attack complexity) to execute arbitrary code with root privileges by installing a signed-b...

EUVD-2026-58802

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: slsa-verifier, cosign-fips, gh, cosign...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: cosign, slsa-verifier, gh...

CVE-2026-18622

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of...

Linux Distros Unpatched Vulnerability : CVE-2026-59112

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority...

CVE-2026-63362

A flaw was found in open62541. An unsigned integer underflow in the PubSub signature verification path may allow a remote attacker to cause a denial of service by sending a specially crafted User Datagram Protocol UDP packet. This vulnerability could make the affected system unavailable to...

CVE-2026-68757 Potential improper SAML signature verification in JFrog Artifactory

A user with access to a valid SAML response may impersonate another user under specific conditions...

CVE-2026-68757

CVE-2026-68757 concerns JFrog Artifactory where a user with a valid SAML response may impersonate another user due to a potential improper SAML signature verification. The connected documents corroborate the basic vulnerability description and label it in CVE lists as a potential SAML-signature-v...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

CVE-2026-59112

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority RIA libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4:...

CVE-2026-59112

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority RIA libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4:...

CVE-2026-59112

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority RIA libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4:...