922 matches found
SUSE CVE-2026-54787
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...
GHSA-WQQC-JJCQ-VFXM sigstore-go fails to check signature timestamps against a signing key's validity period
sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys without certificates. Impact To verify a bundle with a self-managed long-lived key, the key needs to be wrapped in an ExpiringKey type that implies expiration semantics: go...
EUVD-2026-51665
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...
CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key's validity period
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...
CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key's validity period
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...
CVE-2026-54787
CVE-2026-54787 affects the Go library sigstore-go. Before 1.2.1, it does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a long‑lived signing key without a certificate, enabling an attacker with expired key material to sign accepted bundles. The issue i...
EUVD-2026-51478
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...
CVE-2026-18218
The vulnerability CVE-2026-18218 affects Keycloak’s TokenManager component. When an administrator revokes tokens for a specific client under a not-before policy, revocation can be silently ignored if the realm’s overall not-before policy is older but non-zero. As a result, previously issued token...
CVE-2026-18218 Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...
Symbolic Attack Chain Generation from Atomic Red Team Techniques: An Empirical Study of Predicate Representation Granularity
Automated attack chain generation is critical for modern cybersecurity, yet manual construction fails to scale as adversary behaviors expand. While classical AI planning using PDDL offers a formal method to automate this process, it relies on the accurate translation of techniques into symbolic...
CVE-2026-18257
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted...
EUVD-2026-50410
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted...
CVE-2026-18257 Improper Certificate Validation in S2OPC
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted...
CVE-2026-18257
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted...
PT-2026-65843
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted...
GHSA-QF5V-M7P4-95RP Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption
Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer, but the capability check was implemented as a fixed denylist of six Linux...
The Disruptive Impact of Large Language Models on Capture the Flag Competitions and the Path toward Fair Play
Capture the Flag CTF competitions are among cybersecurity's most effective training grounds, developing practical skill across cryptography, web exploitation, and binary exploitation. Large language models LLMs can now solve a growing share of challenges with minimal human input, raising urgent...
PT-2026-64018
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...
SUSE CVE-2026-53383
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...
CVE-2026-64132
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...