ANT-2026-7R9KHDAS · cloudflare/circl · Signature Verification Bypass / Universal Forgery

other critical Severity Claude critical · Security research firm - · Maintainer - REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-7R9KHDAS: CIRCL sign/bls: universal signature forgery in KeyG2SigG1 via G1-infinity point In the KeyG2SigG1 configuration of...

ANT-2026-BT210RQ0 · libtom/libtomcrypt · Cryptographic Logic Flaw

other critical Severity Claude critical · Security research firm - · Maintainer - REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-BT210RQ0: libtomcrypt AES-SIV: universal forgery and plaintext recovery when called without AD In src/encauth/siv/siv.c, ssivS2V and the...

Missing Cryptographic Step

Overview Affected versions of this package are vulnerable to Missing Cryptographic Step in the AES-OCB provider when an application uses the EVPCipher interface. The handler silently discards the IV, so every message under a given key runs with the all-zero offset state, causing nonce reuse. If...

AZL-89876 CVE-2026-45445 affecting package edk2 for versions less than 20240524git3e722403cd16-18

Issue summary: When an application drives an AES-OCB context through the public EVPCipher one-shot interface, the application-supplied initialisation vector IV is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV...

AZL-89793 CVE-2026-45445 affecting package openssl-fips-provider 3.1.2-2

Issue summary: When an application drives an AES-OCB context through the public EVPCipher one-shot interface, the application-supplied initialisation vector IV is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV...

ANT-2026-KNXJMVYC · wolfSSL · signature-bypass

signature-bypass high CVE-2026-5466 GHSA-47qf-hp3h-rwmm Severity Claude high · Security research firm high · Maintainer high Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-KNXJMVYC: Universal ECCSI...

SLasH-DSA: Breaking SLH-DSA Using an Extensible End-To-End Rowhammer Framework

As quantum computing advances, PQC schemes are adopted to replace classical algorithms. Among them is the SLH-DSA that was recently standardized by NIST and is favored for its conservative security foundations. In this work, we present the first software-only universal forgery attack on SLH-DSA,...

PT-2023-19366 · Pqclean · Pqclean

Name of the Vulnerable Software and Affected Versions: PQClean version d03da30 Description: The issue allows universal forgeries of digital signatures via a template side-channel attack because of intermediate data leakage of one vector. This is related to CRYSTALS-DILITHIUM in Post-Quantum...