CVE-2026-102946 | Critical | 9.1 | 2026-10-15 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deseria… |
CVE-2026-110765 | Medium | 5.9 | 2026-10-14 | FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature… |
CVE-2026-95633 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An att… |
CVE-2026-95632 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An att… |
CVE-2026-103297 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An att… |
CVE-2026-103296 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An att… |
CVE-2026-102502 | Medium | 5.3 | 2026-10-13 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An att… |
CVE-2026-97799 | High | 7.8 | 2026-10-13 | Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-96957 | High | 8.8 | 2026-10-13 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-96252 | Critical | 9.1 | 2026-10-13 | Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-87696 | High | 7.5 | 2026-10-13 | Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-85818 | Critical | 9.0 | 2026-10-13 | Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-83798 | Medium | 5.5 | 2026-10-13 | Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally. |
CVE-2026-70071 | Medium | 5.5 | 2026-10-13 | Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally. |
CVE-2026-69650 | High | 7.8 | 2026-10-13 | Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally. |
CVE-2026-102866 | High | 8.1 | 2026-10-13 | Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-65197 | Low | 3.1 | 2026-10-13 | H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable b… |
CVE-2026-108971 | Critical | 9.6 | 2026-10-13 | A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recov… |
CVE-2026-85962 | High | 7.5 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In d… |
CVE-2026-103902 | High | 7.5 | 2026-10-12 | Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The… |
CVE-2026-108699 | Medium | 6.5 | 2026-10-11 | hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_ve… |
CVE-2026-106581 | | | 2026-10-09 | Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able… |
CVE-2026-86405 | Critical | 9.8 | 2026-10-09 | Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signatu… |
CVE-2026-85531 | Critical | 9.8 | 2026-10-09 | Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature… |
CVE-2026-103329 | Medium | 5.3 | 2026-10-09 | The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used… |
CVE-2026-107724 | High | 7.4 | 2026-10-08 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because sr… |
CVE-2026-107722 | Critical | 9.8 | 2026-10-08 | fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key… |
CVE-2026-107720 | High | 7.4 | 2026-10-08 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null… |
CVE-2026-84271 | High | 7.8 | 2026-10-08 | IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vul… |
CVE-2026-14999 | High | 7.4 | 2026-10-08 | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacke… |
CVE-2026-14497 | High | 8.1 | 2026-10-08 | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authent… |
CVE-2026-76482 | Critical | 10.0 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software… |
CVE-2026-79807 | High | 7.8 | 2026-10-06 | A missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local instance to e… |
CVE-2026-25302 | High | 7.1 | 2026-10-06 | Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted a… |
CVE-2026-78860 | High | 7.8 | 2026-10-05 | An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext |
CVE-2026-77805 | High | 7.9 | 2026-10-05 | In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by th… |
CVE-2026-105161 | Medium | 5.3 | 2026-10-04 | A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a m… |
CVE-2026-105118 | Medium | 4.7 | 2026-10-03 | OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint t… |
CVE-2026-71891 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPo… |
CVE-2026-71887 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no… |
CVE-2026-104437 | High | 7.4 | 2026-10-02 | Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs… |
CVE-2026-104435 | High | 7.4 | 2026-10-02 | Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corr… |
CVE-2026-86326 | | | 2026-10-02 | An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic aut… |
CVE-2026-63571 | | | 2026-10-02 | Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder)… |
CVE-2026-18397 | | | 2026-10-01 | This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory… |
CVE-2026-94212 | | | 2026-10-01 | Improper verification of cryptographic signature vulnerability in Apache APISIX.
Any unauthenticated attacker could impersonate any user on every route prot… |
CVE-2026-103245 | Medium | 5.3 | 2026-10-01 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node w… |
CVE-2026-87004 | High | 8.1 | 2026-09-30 | Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/p… |
CVE-2026-55174 | Medium | 5.9 | 2026-09-30 | UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes… |
CVE-2026-47554 | High | 7.1 | 2026-09-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signatures may cause signatu… |
CVE-2026-102508 | | | 2026-09-30 | Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a netwo… |
CVE-2026-91191 | High | 7.5 | 2026-09-29 | The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock don… |
CVE-2026-100293 | High | 8.8 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relyi… |
CVE-2026-102273 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only… |
CVE-2026-102272 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-… |
CVE-2026-102271 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard… |
CVE-2026-102268 | Critical | 9.1 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recogni… |
CVE-2026-102266 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used… |
CVE-2026-96760 | Critical | 9.8 | 2026-09-28 | Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization… |
CVE-2026-94418 | High | 7.5 | 2026-09-27 | Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges th… |
CVE-2025-71422 | Medium | 5.7 | 2026-09-27 | Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host… |
CVE-2026-84465 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email… |
CVE-2026-61855 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed e… |
CVE-2026-56727 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the g… |
CVE-2026-97732 | Medium | 5.1 | 2026-09-25 | IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate st… |
CVE-2026-97731 | High | 7.1 | 2026-09-25 | MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSigne… |
CVE-2026-57178 | High | 7.4 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data withou… |
CVE-2026-91187 | | | 2026-09-24 | Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary… |
CVE-2026-91814 | Medium | 5.3 | 2026-09-23 | A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content m… |
CVE-2026-18152 | High | 7.4 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cry… |
CVE-2026-85995 | High | 7.3 | 2026-09-22 | Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP… |
CVE-2026-95503 | Medium | 6.8 | 2026-09-22 | A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication… |
CVE-2026-75939 | High | 7.4 | 2026-09-21 | A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors befo… |
CVE-2026-94368 | High | 7.1 | 2026-09-21 | A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the serv… |
CVE-2026-9832 | Medium | 5.3 | 2026-09-19 | The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and… |
CVE-2026-59163 | Critical | 9.1 | 2026-09-18 | Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and p… |
CVE-2026-93657 | High | 7.5 | 2026-09-18 | hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing inv… |
CVE-2026-28199 | Low | 3.3 | 2026-09-18 | An authenticated user with access to the NetBackup Flex OS management
shell could read arbitrary files from the underlying operating system by
supplying a sp… |
CVE-2026-28198 | High | 8.8 | 2026-09-18 | An authenticated, low-privileged user with access to the NetBackup Flex
OS management shell could bypass the cryptographic signature
verification step of a p… |
CVE-2026-54581 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap in… |
CVE-2026-86038 | High | 7.5 | 2026-09-17 | libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in package… |
CVE-2026-78223 | | | 2026-09-17 | Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a… |
CVE-2026-92718 | High | 7.3 | 2026-09-16 | Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verif… |
CVE-2026-42784 | High | 7.4 | 2026-09-16 | A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discre… |
CVE-2026-86585 | | | 2026-09-16 | The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker who control… |
CVE-2026-86109 | Medium | 6.6 | 2026-09-16 | The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the d… |
CVE-2026-58200 | High | 7.1 | 2026-09-15 | Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with cl… |
CVE-2026-54155 | High | 7.7 | 2026-09-14 | node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-se… |
CVE-2026-57122 | High | 8.6 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or… |
CVE-2026-87802 | Critical | 9.1 | 2026-09-14 | Improper verification of cryptographic signature vulnerability in Apache Syncope.
When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an att… |
CVE-2026-54248 | Medium | 6.5 | 2026-09-11 | Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1… |
CVE-2026-80469 | High | 8.3 | 2026-09-11 | An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, a… |
CVE-2026-73784 | High | 8.8 | 2026-09-11 | A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user. |
CVE-2026-89169 | | | 2026-09-11 | live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. |
CVE-2026-89086 | Critical | 9.1 | 2026-09-10 | In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the… |
CVE-2026-89043 | High | 7.4 | 2026-09-10 | passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent X… |
CVE-2026-89042 | Critical | 9.1 | 2026-09-10 | passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by… |
CVE-2023-54355 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers… |
CVE-2026-79970 | Medium | 5.6 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Verification of Cryptograph… |
CVE-2026-56207 | Critical | 9.8 | 2026-09-09 | Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as anoth… |