237 matches found
EUVD-2026-49666
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
CVE-2026-49852
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...
CVE-2026-53947
Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is...
keylime: Keylime: Security bypass due to hardcoded TPM quote nonce
A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module TPM quote attestation instead of a...
CVE-2026-42731
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through = 5.4.9...
Krajowa Izba Rozliczeniowa Szafir SDK 安全漏洞
Krajowa Izba Rozliczeniowa Szafir SDK is an electronic signature development kit from Krajowa Izba Rozliczeniowa, Poland. A security vulnerability exists in the Krajowa Izba Rozliczeniowa Szafir SDK that stems from the cryptographic digital signature verification process returning a success statu...
Linux kernel 安全漏洞
The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the lack of verification of the release report content for RTL8922DE in rtw89 PCI, potentially leading ...
CLSA-2026-1775119189 gnupg2: Fix of CVE-2025-30258
CVE-2025-30258: fix verification DoS due to a malicious subkey in the keyring...
GHSA-VM9R-H74P-HG97 jose vulnerable to untrusted JWK header key acceptance during signature verification
Impact A vulnerability in jose versions up to and including 0.3.5 could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header jwk. The vulnerability exists because key selection could treat header-provided jwk as a verification candidat...
jsrsasign 安全漏洞
jsrsasign is a signature verification library developed by Kenji Urushima. Versions of jsrsasign prior to 11.1.1 contained security vulnerabilities. These vulnerabilities stemmed from numerical type conversion errors during the handling of negative exponents in the ext/jsbn2.js file, which could...
CVE-2026-33243
Barebox contains a vulnerability in the FIT signing flow: during mkimage, the hashed-nodes property of the FIT signature node is computed, but the hashed-nodes value is not itself protected by the hash. An attacker can modify hashed-nodes to influence which nodes were reported as hashed, potentia...
Cross-site Request Forgery (CSRF)
fastapi-sso is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to missing persistence and verification of the OAuth state parameter, which allows an attacker to supply a malicious callback URL and link their account to a victim’s session...
GHSA-HPWG-XG7M-3P6M sm-crypto Affected by Signature Forgery in SM2-DSA
Summary A signature forgery vulnerability exists in the SM2 signature verification logic of sm-crypto. Under default configurations, an attacker can forge valid signatures for arbitrary public keys. If the message space contains sufficient redundancy, the attacker can fix the prefix of the messag...
PT-2026-3894
Name of the Vulnerable Software and Affected Versions sm-crypto versions prior to 0.3.14 Description The sm-crypto library, providing JavaScript implementations of Chinese cryptographic algorithms SM2, SM3, and SM4, contains a signature malleability issue in its SM2 signature verification logic. ...
CVE-2025-68964
Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2025-68964
CVE-2025-68964 affects Huawei HarmonyOS HiView module. Public docs describe a data verification vulnerability in HiView that can impact availability if exploited. Descriptions from multiple sources (NVD, Red Hat, CIRCL, CNNVD, etc.) reiterate the issue as a data verification flaw in the HiView co...
CVE-2025-68964
Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect availability...
PT-2026-2569
Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect availability...