CVE-2026-74244 | Medium | 5.9 | 2026-08-14 | A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending cra… |
CVE-2026-19910 | High | 7.5 | 2026-08-14 | PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attacker… |
CVE-2026-47192 | | | 2026-08-14 | kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configura… |
CVE-2026-47191 | | | 2026-08-14 | kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a r… |
CVE-2026-56865 | High | 8.4 | 2026-08-13 | A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-… |
CVE-2026-56864 | High | 7.5 | 2026-08-13 | A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY an… |
CVE-2026-28148 | Critical | 9.8 | 2026-08-13 | Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. |
CVE-2026-12263 | High | 8.8 | 2026-08-13 | Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due t… |
CVE-2026-48791 | Low | 2.0 | 2026-08-13 | sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor e… |
CVE-2026-68759 | High | 7.2 | 2026-08-12 | A holder of a valid integration credential may impersonate other users under specific conditions. |
CVE-2026-68757 | High | 7.5 | 2026-08-12 | A user with access to a valid SAML response may impersonate another user under specific conditions. |
CVE-2025-59324 | Critical | 9.1 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity c… |
CVE-2025-59327 | High | 7.5 | 2026-08-12 | In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro… |
CVE-2026-62757 | Medium | 5.3 | 2026-08-11 | Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-15556 | High | 8.1 | 2026-08-11 | A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker… |
CVE-2026-10579 | Critical | 9.8 | 2026-08-11 | A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting a… |
CVE-2026-66776 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low p… |
CVE-2026-10754 | | | 2026-08-10 | Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security co… |
CVE-2026-59112 | | | 2026-08-10 | Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authorit… |
CVE-2026-16742 | Medium | 6.7 | 2026-08-10 | systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user |
CVE-2026-58262 | | | 2026-08-07 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubK… |
CVE-2026-62918 | High | 7.5 | 2026-08-07 | Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-62873 | Critical | 9.8 | 2026-08-07 | Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-5430 | Critical | 10.0 | 2026-08-06 | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a… |
CVE-2026-7557 | Critical | 9.1 | 2026-08-05 | An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allow… |
CVE-2026-16443 | High | 7.4 | 2026-08-05 | A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build… |
CVE-2026-18569 | Low | 3.7 | 2026-08-04 | A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles… |
CVE-2026-46713 | | | 2026-08-03 | Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature… |
CVE-2026-18568 | High | 7.5 | 2026-08-03 | XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cr… |
CVE-2026-9487 | Critical | 9.1 | 2026-08-03 | XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.
_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the Sign… |
CVE-2026-18108 | Critical | 9.8 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content… |
CVE-2026-18092 | High | 8.1 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with documen… |
CVE-2026-18089 | High | 7.5 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when n… |
CVE-2026-0392 | | | 2026-08-03 | eParakstītājs 3.0 for Windows before version
1.10.0 retrieves and executes its automatic updates over a channel that is not
authenticated or integrity-protecte… |
CVE-2026-12860 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java L… |
CVE-2026-59643 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA)… |
CVE-2026-59639 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS b… |
CVE-2026-55735 | High | 7.5 | 2026-08-01 | Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token.
Gu… |
CVE-2025-71402 | | | 2026-08-01 | better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-se… |
CVE-2026-53501 | High | 8.2 | 2026-07-31 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace()… |
CVE-2026-44104 | Critical | 9.8 | 2026-07-30 | The firmware update process for the basemodule of the charging controller only validates the
CRC32 checksum without cryptographic signature verification. This… |
CVE-2026-17872 | Medium | 6.1 | 2026-07-30 | Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a… |
CVE-2026-13305 | Medium | 6.4 | 2026-07-29 | Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability all… |
CVE-2026-59243 | Critical | 9.8 | 2026-07-29 | The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned… |
CVE-2026-63237 | Medium | 4.8 | 2026-07-29 | A TOTP two-factor authentication bypass vulnerability in
Koollab LMS allowed an
attacker to supply a client-controlled seed to generate a matching one-time
pas… |
CVE-2026-65616 | High | 8.8 | 2026-07-27 | Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. |
CVE-2026-14837 | High | 7.8 | 2026-07-27 | Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can b… |
CVE-2026-48021 | Critical | 9.1 | 2026-07-24 | In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake wi… |
CVE-2026-52686 | Low | 3.7 | 2026-07-23 | The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer… |
CVE-2026-13089 | High | 7.5 | 2026-07-22 | OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify.
When the caller… |
CVE-2026-10723 | Medium | 6.8 | 2026-07-22 | BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.
This issue affects BIND 9… |
CVE-2026-64623 | High | 8.6 | 2026-07-20 | Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non… |
CVE-2026-49834 | Medium | 5.9 | 2026-07-17 | sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificate… |
CVE-2026-49998 | High | 8.2 | 2026-07-16 | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allow… |
CVE-2026-45795 | Medium | 5.3 | 2026-07-16 | The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects beca… |
CVE-2026-54733 | | | 2026-07-16 | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5… |
CVE-2026-15013 | Critical | 9.8 | 2026-07-16 | The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, a… |
CVE-2026-46684 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-… |
CVE-2026-48815 | High | 7.5 | 2026-07-14 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is… |
CVE-2026-48758 | Medium | 5.4 | 2026-07-14 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js a… |
CVE-2026-48747 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSi… |
CVE-2026-47212 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doP… |
CVE-2026-47304 | High | 8.1 | 2026-07-14 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-45755 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse()… |
CVE-2026-15265 | Critical | 9.1 | 2026-07-14 | A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin d… |
CVE-2026-56451 | Critical | 10.0 | 2026-07-14 | A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON We… |
CVE-2026-22097 | | | 2026-07-13 | The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload a… |
CVE-2026-54736 | | | 2026-07-10 | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the… |
CVE-2026-9027 | Medium | 5.3 | 2026-07-09 | The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all vers… |
CVE-2026-54783 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and suppo… |
CVE-2026-54782 | Critical | 10.0 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token val… |
CVE-2026-54774 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureVal… |
CVE-2026-54773 | Medium | 5.9 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verificat… |
CVE-2026-46354 | Critical | 9.1 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33… |
CVE-2026-11348 | High | 8.1 | 2026-07-07 | Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data.
This issue affects Liman MYS: before… |
CVE-2026-58426 | Critical | 9.6 | 2026-07-03 | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write |
CVE-2026-13722 | High | 7.2 | 2026-07-03 | WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can… |
CVE-2026-50722 | High | 8.1 | 2026-07-02 | Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH… |
CVE-2026-50721 | High | 8.1 | 2026-07-02 | Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of a… |
CVE-2026-13743 | | | 2026-07-02 | CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. This cou… |
CVE-2025-0824 | Low | 3.7 | 2026-06-29 | Lack of validation for firmware update in Hitachi Hitachi Virtual Storage Platform One Block 23, 24, 26, 28.
This issue affects Hitachi Virtual Storage Platfo… |
CVE-2024-23581 | Medium | 6.7 | 2026-06-26 | The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application. |
CVE-2026-40941 | Medium | 6.5 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which al… |
CVE-2026-7511 | High | 7.5 | 2026-06-25 | PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a forged signature to b… |
CVE-2026-6331 | High | 7.5 | 2026-06-25 | HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibilit… |
CVE-2026-6329 | Medium | 6.5 | 2026-06-25 | PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted… |
CVE-2026-11800 | High | 8.1 | 2026-06-25 | A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials t… |
CVE-2026-55961 | High | 7.5 | 2026-06-25 | wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the unde… |
CVE-2026-9779 | High | 7.2 | 2026-06-24 | ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2026-46423 | | | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rock… |
CVE-2026-46349 | Medium | 5.3 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activitie… |
CVE-2026-49454 | Critical | 9.1 | 2026-06-18 | Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0.0 and 1.1.0 accept forged SAML signatures because Signatur… |
CVE-2026-42743 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions. |
CVE-2026-48558 | Critical | 10.0 | 2026-06-12 | SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC aut… |
CVE-2026-50010 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerF… |
CVE-2026-50634 | Medium | 6.5 | 2026-06-12 | A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted sign… |
CVE-2026-41005 | Critical | 9.0 | 2026-06-11 | Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (a… |
CVE-2026-10795 | High | 8.1 | 2026-06-11 | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the… |
CVE-2026-42462 | High | 7.0 | 2026-06-10 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an atta… |
CVE-2026-52754 | High | 8.8 | 2026-06-10 | Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certif… |