MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on...

CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

CVE-2026-74876

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

CVE-2026-74876 openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

CVE-2026-74876

In openssl_encrypt before 1.4.0, PublicKeyBundle.from_dict() accepts untrusted key bundle data without signature verification. Attackers can craft a malicious bundle, call to_identity(), and encrypt secrets to an attacker-controlled public key, enabling confidential data exfiltration. CVSS 9.8 cr...

CVE-2026-74244

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

CVE-2026-74244

Affects Red Hat Quay: Stripe billing webhook handler failing to validate Stripe-Signature on /webhooks/stripe allows unauthenticated forging of billing events. Exploitation can reset a namespace's build quota to maximum and trigger unsolicited billing emails to namespace admins. Root cause: lack ...

CVE-2026-19910

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...

CVE-2026-19910 PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...

CVE-2026-47192

kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the...

Improper Verification Of Cryptographic Signature

Spring Security is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to SAML Responses and LogoutRequest/LogoutResponse elements being decrypted without requiring a valid signature, which allows an attacker to craft malicious SAML payloads and use the Servic...

CVE-2026-47192

CVE-2026-47192 affects kas (bitbake project setup tool). From 4.8 up to 5.3, kas may checkout and process repositories for configuration includes before validating signatures, under very specific conditions. If an attacker controls a referenced repository and the victim’s kas config includes a fi...

CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840

OpenChoreo is affected by a vulnerability in the POST /api/v1alpha1/autobuild endpoint (internal/openchoreo-api/api/handlers/webhook_handler.go) where a webhook provider is chosen from caller-controlled X-Event-Key, Bitbucket requests may be accepted without HMAC-SHA256 in X-Hub-Signature or a co...

CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-62757

Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-56649

Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-72922

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogptplatform/backend/backend/api/features/integrations/router.py webhookingressgeneric route selected getwebhookmanagerprovider from the untrust...

CVE-2026-72922 AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogptplatform/backend/backend/api/features/integrations/router.py webhookingressgeneric route selected getwebhookmanagerprovider from the untrust...

PT-2026-70516

Name of the Vulnerable Software and Affected Versions Windows Schannel affected versions not specified Description Improper verification of cryptographic signatures in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network. Recommendations At the moment, ther...