EUVD-2026-113215

SD JWT JS: Tampered disclosures silently dropped instead of rejected...

GhostlyHollowingViaTamperedSyscalls2

Ghostly Hollowing Via Tampered Syscalls Reupload Notice !NOTE The original repository previously used an incorrect license that omitted attribution to the founder of DeceptIQ, @Rad9800, whose TamperingSyscalls repository is published under the MIT License. His work was already credited in the...

CVE-2024-3094

Good evening, I would like to inform you about a critical security issue that has been identified and directly affects the Linux community, including servers and Android devices. It was discovered that one of the contributors, known by the name of Jesse, has been distributing corrupted binaries...

CVE-2026-62374

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

CVE-2026-62374

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, "@sd-jwt/decode", also used by "@sd-jwt/core", silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed "sd" array and returns a reduced claim...

CVE-2026-62374 SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

CVE-2026-62374

The SD JWT JS JavaScript implementation of the Selective Disclosure JWT specification contains a vulnerability in version 0.19.0 and earlier . Specifically, the @sd-jwt/decode component (used by @sd-jwt/core) silently drops tampered Disclosures instead of rejecting them. When a Disclosure's diges...

CVE-2026-62374 SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

PT-2026-132399

Name of the Vulnerable Software and Affected Versions @sd-jwt/core versions prior to 0.20.0 @sd-jwt/decode versions prior to 0.20.0 Description In the @sd-jwt/decode component, also utilized by @sd-jwt/core, the system silently drops tampered Disclosures if their digest does not match the...

CVE-2026-62374: openwallet-foundation: SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

CVE-2026-94447

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...