CVE-2026-102273 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only… |
CVE-2026-102272 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-… |
CVE-2026-102271 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard… |
CVE-2026-102268 | Critical | 9.1 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recogni… |
CVE-2026-102266 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used… |
CVE-2026-94418 | | | 2026-09-27 | Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges th… |
CVE-2025-71422 | Medium | 5.7 | 2026-09-27 | Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host… |
CVE-2026-84465 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email… |
CVE-2026-61855 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed e… |
CVE-2026-56727 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the g… |
CVE-2026-97732 | Medium | 5.1 | 2026-09-25 | IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate st… |
CVE-2026-97731 | High | 7.1 | 2026-09-25 | MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSigne… |
CVE-2026-57178 | High | 7.4 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data withou… |
CVE-2026-91187 | | | 2026-09-24 | Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary… |
CVE-2026-91814 | Medium | 5.3 | 2026-09-23 | A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content m… |
CVE-2026-18152 | High | 7.4 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cry… |
CVE-2026-85995 | High | 7.3 | 2026-09-22 | Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP… |
CVE-2026-95503 | Medium | 6.8 | 2026-09-22 | A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication… |
CVE-2026-75939 | High | 7.4 | 2026-09-21 | A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors befo… |
CVE-2026-94368 | High | 7.1 | 2026-09-21 | A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the serv… |
CVE-2026-9832 | Medium | 5.3 | 2026-09-19 | The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and… |
CVE-2026-59163 | Critical | 9.1 | 2026-09-18 | Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and p… |
CVE-2026-93657 | High | 7.5 | 2026-09-18 | hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing inv… |
CVE-2026-28199 | Low | 3.3 | 2026-09-18 | An authenticated user with access to the NetBackup Flex OS management
shell could read arbitrary files from the underlying operating system by
supplying a sp… |
CVE-2026-28198 | High | 8.8 | 2026-09-18 | An authenticated, low-privileged user with access to the NetBackup Flex
OS management shell could bypass the cryptographic signature
verification step of a p… |
CVE-2026-54581 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap in… |
CVE-2026-86038 | High | 7.5 | 2026-09-17 | libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in package… |
CVE-2026-78223 | | | 2026-09-17 | Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a… |
CVE-2026-92718 | High | 7.3 | 2026-09-16 | Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verif… |
CVE-2026-42784 | High | 7.4 | 2026-09-16 | A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discre… |
CVE-2026-86585 | | | 2026-09-16 | The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker who control… |
CVE-2026-86109 | Medium | 6.6 | 2026-09-16 | The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the d… |
CVE-2026-58200 | High | 7.1 | 2026-09-15 | Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with cl… |
CVE-2026-54155 | High | 7.7 | 2026-09-14 | node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-se… |
CVE-2026-57122 | High | 8.6 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or… |
CVE-2026-87802 | Critical | 9.1 | 2026-09-14 | Improper verification of cryptographic signature vulnerability in Apache Syncope.
When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an att… |
CVE-2026-54248 | Medium | 6.5 | 2026-09-11 | Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1… |
CVE-2026-80469 | High | 8.3 | 2026-09-11 | An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, a… |
CVE-2026-73784 | High | 8.8 | 2026-09-11 | A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user. |
CVE-2026-89169 | | | 2026-09-11 | live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. |
CVE-2026-89086 | Critical | 9.1 | 2026-09-10 | In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the… |
CVE-2026-89043 | High | 7.4 | 2026-09-10 | passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent X… |
CVE-2026-89042 | Critical | 9.1 | 2026-09-10 | passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by… |
CVE-2023-54355 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers… |
CVE-2026-79970 | Medium | 5.6 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Verification of Cryptograph… |
CVE-2026-56207 | Critical | 9.8 | 2026-09-09 | Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as anoth… |
CVE-2026-87732 | Medium | 6.2 | 2026-09-09 | An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into funct… |
CVE-2026-86080 | Medium | 5.3 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when… |
CVE-2026-52486 | Medium | 6.6 | 2026-09-08 | An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module |
CVE-2026-69646 | High | 8.3 | 2026-09-08 | Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network. |
CVE-2026-28590 | High | 7.8 | 2026-09-08 | In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privileg… |
CVE-2026-57098 | High | 7.5 | 2026-09-08 | Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-77105 | High | 8.8 | 2026-09-08 | CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Up… |
CVE-2026-14296 | High | 7.5 | 2026-09-07 | When using the Direct XIP
update strategy, the main application image starts other cores (i.e. radio
core), based on the currently active slot without addition… |
CVE-2026-86304 | Critical | 9.8 | 2026-09-06 | MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust… |
CVE-2026-67278 | Critical | 9.1 | 2026-09-05 | MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentic… |
CVE-2026-67276 | High | 8.1 | 2026-09-05 | RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus… |
CVE-2026-52767 | High | 8.2 | 2026-09-05 | YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl… |
CVE-2026-79389 | High | 7.4 | 2026-09-04 | Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT mes… |
CVE-2026-85525 | High | 7.4 | 2026-09-04 | Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCS… |
CVE-2026-80098 | Critical | 9.3 | 2026-09-03 | Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-84185 | Medium | 5.9 | 2026-09-03 | A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the l… |
CVE-2026-85394 | Critical | 9.1 | 2026-09-03 | python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefi… |
CVE-2026-85393 | High | 7.5 | 2026-09-03 | node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed… |
CVE-2026-80465 | High | 8.7 | 2026-09-03 | A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3)… |
CVE-2026-82955 | | | 2026-09-02 | In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had… |
CVE-2026-73776 | High | 7.9 | 2026-09-01 | A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious ac… |
CVE-2026-82876 | High | 8.2 | 2026-08-31 | Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutabl… |
CVE-2026-82645 | High | 8.6 | 2026-08-30 | AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a… |
CVE-2026-75759 | | | 2026-08-30 | Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encryp… |
CVE-2026-82461 | High | 8.1 | 2026-08-29 | pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can f… |
CVE-2026-82454 | Critical | 9.1 | 2026-08-29 | The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken fu… |
CVE-2026-76581 | Critical | 9.8 | 2026-08-28 | The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and… |
CVE-2026-54330 | High | 8.1 | 2026-08-28 | Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway… |
CVE-2026-81717 | Low | 3.5 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable d… |
CVE-2026-81714 | High | 7.0 | 2026-08-27 | openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust ancho… |
CVE-2026-81701 | Critical | 9.8 | 2026-08-27 | openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unkn… |
CVE-2026-81700 | Critical | 9.8 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by onl… |
CVE-2026-81680 | Medium | 4.0 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slo… |
CVE-2026-57910 | | | 2026-08-25 | Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevat… |
CVE-2026-75946 | | | 2026-08-21 | A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could potentially allow a… |
CVE-2026-68745 | High | 8.1 | 2026-08-21 | Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML resp… |
CVE-2026-62834 | Critical | 9.3 | 2026-08-20 | Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-72861 | Medium | 5.8 | 2026-08-20 | The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src… |
CVE-2026-19505 | Critical | 9.8 | 2026-08-19 | Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentic… |
CVE-2026-76234 | High | 7.5 | 2026-08-19 | libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check len… |
CVE-2026-50720 | Medium | 6.4 | 2026-08-19 | The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SH… |
CVE-2026-50719 | Medium | 6.8 | 2026-08-19 | The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the s… |
CVE-2026-72889 | Critical | 9.8 | 2026-08-19 | Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify.
verify resolves the signature method class from the sig… |
CVE-2026-58085 | High | 7.5 | 2026-08-19 | After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The drive… |
CVE-2026-55165 | Medium | 4.8 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] fr… |
CVE-2025-9210 | High | 8.1 | 2026-08-18 | Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate pri… |
CVE-2021-43716 | Critical | 9.8 | 2026-08-18 | Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by encrypted firmware th… |
CVE-2026-74901 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenti… |
CVE-2026-74876 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying sig… |
CVE-2026-18500 | High | 8.1 | 2026-08-15 | @fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently… |
CVE-2026-74244 | Medium | 5.9 | 2026-08-14 | A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending cra… |
CVE-2026-19910 | High | 7.5 | 2026-08-14 | PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attacker… |
CVE-2026-47192 | | | 2026-08-14 | kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configura… |
CVE-2026-47191 | | | 2026-08-14 | kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a r… |