56831 matches found
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
CVE-2026-107723
fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...
GHSA-8WPC-H4Q6-8FXV fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...
Improper Verification of Cryptographic Signature
Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via createVerifier in src/verifier.js, when an empty string or null is passed as the key option. Because the falsy-key branch skipped key...
Improper Verification of Cryptographic Signature
Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the key-type detection logic in src/crypto.js, where a non-whitespace prefix control characters, zero-width Unicode, comments, HTTP/PG...
Improper Verification of Cryptographic Signature
Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via performDetectPublicKeyAlgorithms and performDetectPrivateKeyAlgorithm in src/crypto.js, when a serialized asymmetric JWK or JWKS is...
CVE-2026-107723
The fast-jwt library (versions prior to 6.3.0 ) is vulnerable to a silent claim-validator bypass when a JWT payload is a JSON array . The root cause is located in src/decoder.js, where the system verifies that the payload is an object but fails to reject arrays. Because the claim validator loop l...
CVE-2026-88647
A flaw was found in GnuTLS. This vulnerability can lead to information disclosure by allowing an attacker to bypass certificate hostname verification. A remote attacker presenting a crafted certificate can circumvent the Common Name fallback check, enabling them to eavesdrop on or intercept...
CVE-2026-84271
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...
CopyFail-Experiment
Just an experiment to verify that the LLM can find this vuln and construct a working exploit. Usage gcc -o poc poc.c ./poc...
CVE-2026-84271
IBM Guardium Data Protection 12.2 contains a signature verification bypass vulnerability within the patch installer. An attacker with local access could exploit this flaw to achieve arbitrary code execution with root privileges . The root cause is identified as a race condition (CWE-362). No spec...
EUVD-2026-95240
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...
CVE-2026-84271 IBM Guardium Data Protection Signature Verification Bypass
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...
WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by KevineCharles in WordPress Plugin miniorange otp verification versions = 5.5.7...
DEBIAN-CVE-2026-88647
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate...
AZL-107445 CVE-2026-88647 affecting package gnutls 3.8.13-1
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate...
CVE-2026-88647
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate...
