PT-2026-132788

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

EUVD-2026-110532

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...

CVE-2026-116825

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...

CVE-2026-116825 YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...

CVE-2026-116825 YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...

CVE-2026-116825

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...

CVE-2026-116825

The YesWiki software (versions 4.6.2 before 4.7.0 ) is vulnerable to an HTTP Signature Replay attack via the ActivityPub Inbox. The root cause is located in HttpSignatureService::verifySignature(), which fails to validate the Date header or track previously seen signatures. An attacker who captur...

PT-2026-125530

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...

CVE-2026-52767: Improper Verification of Cryptographic Signature

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature checks the result of PHP's opensslverify with a loose boolean negation - if !opensslverify... throw ... . PHP's opensslverify has four possible return values: 1, 0, -1, and...

CVE-2026-52767

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature checks the result of PHP's opensslverify with a loose boolean negation - if !opensslverify... throw ... . PHP's opensslverify has four possible return values: 1, 0, -1, and...

PT-2026-57028

Name of the Vulnerable Software and Affected Versions YesWiki versions 4.6.2 through 4.6.5 Description An authentication bypass exists in the ActivityPub implementation due to the incorrect handling of the return value from the openssl verify function in HttpSignatureService::verifySignature. The...

EUVD-2026-33788

In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0069

In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0069

A resource exhaustion vulnerability exists in the verifySignature method of the ApkChecksums.java class within the Framework component of the Android operating system. An attacker can exploit this flaw to cause a crash, leading to a local denial of service (DoS) without requiring additional execu...

PT-2026-45582

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A resource exhaustion issue exists in the verifySignature function of the ApkChecksums.java file within the Framework component. This flaw allows a local attacker to cause a system crash,...

ASB-A-480126173

Bulletin has no description...

CVE-2024-39698

electron-updater allows for automatic updates for Electron apps. The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by cmd.exe expands any...

_verifySignature function does not handle invalid signature

Lines of code Vulnerability details Impact The verifySignature function checks if the provided signature is valid by calling the internal function assertValidSignature. However, if the signature is not valid, the function does not handle the case and continues with the execution, this could lead ...

CVE-2018-19442

The CVE-2018-19442 entry affects Neato Botvac Connected 2.2.0, specifically the /bin/astro binary. A buffer overflow in Network::AuthenticationClient::VerifySignature can be triggered by a crafted POST to vendors/neato/robots/[robot_serial]/messages on nucleo.neatocloud.com (port 4443), allowing ...

CVE-2018-19442: Improper Restriction of Operations within the Bounds of a Memory Buffer

A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker to execute arbitrary code with root privileges via a crafted POST request to a vendors/neato/robots/robotserial/messages Neato cloud URI on the...