56804 matches found
CVE-2026-67693
A flaw was found in GnuTLS. The certificate verification process fails to properly reject end-entity digital certificates containing contradictory Key Usage KU and Extended Key Usage EKU extensions, which define the permitted cryptographic operations of a certificate. A remote attacker could...
CVE-2026-107675
A flaw was found in FFmpeg. The libssh-based SFTP SSH File Transfer Protocol handler fails to verify remote host keys when establishing connections. A remote network attacker capable of intercepting network traffic could exploit this flaw to impersonate legitimate SFTP servers, potentially exposi...
CVE-2026-107660
A flaw was found in ffmpeg. When establishing secure connections using the mbedTLS library, hostname verification is omitted for destinations specified directly by an IP address. A remote network attacker can exploit this flaw by presenting a certificate issued by any trusted Certificate Authorit...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
CVE-2026-107723
fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...
GHSA-8WPC-H4Q6-8FXV fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...
CVE-2026-107723
The fast-jwt library (versions prior to 6.3.0 ) is vulnerable to a silent claim-validator bypass when a JWT payload is a JSON array . The root cause is located in src/decoder.js, where the system verifies that the payload is an object but fails to reject arrays. Because the claim validator loop l...
CVE-2026-88647
A flaw was found in GnuTLS. This vulnerability can lead to information disclosure by allowing an attacker to bypass certificate hostname verification. A remote attacker presenting a crafted certificate can circumvent the Common Name fallback check, enabling them to eavesdrop on or intercept...
CVE-2026-84271
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...
CopyFail-Experiment
Just an experiment to verify that the LLM can find this vuln and construct a working exploit. Usage gcc -o poc poc.c ./poc...
EUVD-2026-95240
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...
CVE-2026-84271 IBM Guardium Data Protection Signature Verification Bypass
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...
CVE-2026-84271
IBM Guardium Data Protection 12.2 contains a signature verification bypass vulnerability within the patch installer. An attacker with local access could exploit this flaw to achieve arbitrary code execution with root privileges . The root cause is identified as a race condition (CWE-362). No spec...
WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by KevineCharles in WordPress Plugin miniorange otp verification versions = 5.5.7...
AZL-107445 CVE-2026-88647 affecting package gnutls 3.8.13-1
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate...
DEBIAN-CVE-2026-88647
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate...
CVE-2026-88647
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate...
