CWE-347 · Improper Verification of Cryptographic Signature (page 2)
Page 2 of 8 — CVEs classified under CWE-347, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41694 | Low | 3.7 | 2026-06-10 | Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attacker… |
CVE-2026-36721 | Critical | 9.8 | 2026-06-09 | A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT… |
CVE-2026-44748 | Critical | 9.9 | 2026-06-09 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modif… |
CVE-2026-45614 | Medium | 4.7 | 2026-06-03 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2026-6873 | Low | 3.1 | 2026-06-03 | An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt deriv… |
CVE-2026-47201 | High | 8.5 | 2026-06-02 | authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML S… |
CVE-2026-48526 | High | 7.4 | 2026-05-28 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC a… |
CVE-2026-48523 | Medium | 5.4 | 2026-05-28 | PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_… |
CVE-2026-9793 | Medium | 5.9 | 2026-05-28 | A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the d… |
CVE-2026-44720 | | 2026-05-27 | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLea… | |
CVE-2025-67903 | Medium | 5.3 | 2026-05-27 | Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass. |
CVE-2025-41669 | High | 8.8 | 2026-05-27 | The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implem… |
CVE-2026-45575 | High | 7.4 | 2026-05-26 | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who can MITM the TLS connection between the… |
CVE-2026-39829 | High | 7.5 | 2026-05-22 | The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could… |
CVE-2026-44714 | High | 7.5 | 2026-05-15 | The bitcoinj library is a Java implementation of the Bitcoin protocol. Prior to 0.17.1, ScriptExecution.correctlySpends() contains two fast-path verification b… |
CVE-2026-44699 | | 2026-05-15 | LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS25… | |
CVE-2026-44309 | Medium | 5.3 | 2026-05-15 | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-enc… |
CVE-2024-36334 | | 2026-05-15 | Improper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the installation directory to be run with elevat… | |
CVE-2026-42602 | High | 8.1 | 2026-05-13 | azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party wh… |
CVE-2026-0265 | High | 8.1 | 2026-05-13 | An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication… |
CVE-2026-33117 | Critical | 9.1 | 2026-05-12 | The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison wa… |
CVE-2026-41431 | High | 8.0 | 2026-05-11 | Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR sig… |
CVE-2026-42193 | Critical | 9.1 | 2026-05-08 | Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads fro… |
CVE-2026-44497 | Critical | 9.1 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a… |
CVE-2026-42501 | High | 7.5 | 2026-05-07 | A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affec… |
CVE-2026-41669 | High | 8.2 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio SAML Identity Provider implementation discards the return value of its… |
CVE-2026-7689 | Low | 3.7 | 2026-05-03 | A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verifyHash in the library htdocs/core/lib/sec… |
CVE-2026-33467 | Medium | 5.9 | 2026-04-28 | Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to o… |
CVE-2026-38651 | High | 8.2 | 2026-04-28 | Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signatu… |
CVE-2026-6986 | Low | 3.7 | 2026-04-25 | A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of… |
CVE-2026-6966 | Medium | 5.3 | 2026-04-24 | Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated user… |
CVE-2026-6911 | Critical | 9.8 | 2026-04-24 | Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the appli… |
CVE-2026-34068 | Medium | 6.8 | 2026-04-22 | nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts `UpdateVal… |
CVE-2026-40372 | Critical | 9.1 | 2026-04-21 | Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-41301 | Medium | 5.3 | 2026-04-21 | OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows pairing challenges… |
CVE-2026-5050 | High | 7.5 | 2026-04-16 | The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and… |
CVE-2026-5588 | High | 7.5 | 2026-04-15 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy C… |
CVE-2026-6328 | | 2026-04-15 | Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation… | |
CVE-2026-24032 | High | 7.3 | 2026-04-14 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC). The affected application contains an authentication weakness due to insuff… |
CVE-2026-0234 | Critical | 9.1 | 2026-04-13 | An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that… |
CVE-2026-5466 | High | 8.1 | 2026-04-10 | wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the signature blob via `mp_read_unsigned_bin` with no check that t… |
CVE-2026-40070 | High | 8.1 | 2026-04-09 | BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to… |
CVE-2026-35205 | High | 7.8 | 2026-04-09 | Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification… |
CVE-2026-39413 | Medium | 4.2 | 2026-04-08 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an… |
CVE-2026-32144 | High | 7.4 | 2026-04-07 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing s… |
CVE-2026-2625 | Medium | 4.0 | 2026-04-03 | A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During th… |
CVE-2026-34840 | High | 8.1 | 2026-04-02 | OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implementation (App/FeatureSet/Identity/Utils… |
CVE-2026-33746 | Critical | 9.8 | 2026-04-02 | Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify… |
CVE-2026-34872 | Critical | 9.1 | 2026-04-01 | An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input… |
CVE-2026-34240 | High | 7.5 | 2026-03-31 | JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote att… |
CVE-2026-34377 | High | 8.1 | 2026-03-31 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verificat… |
CVE-2026-34155 | Medium | 5.3 | 2026-03-31 | RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB ca… |
CVE-2026-32883 | Medium | 5.9 | 2026-03-30 | Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate s… |
CVE-2026-31946 | Critical | 9.8 | 2026-03-30 | OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, Op… |
CVE-2026-33026 | Critical | 9.1 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encryp… |
CVE-2026-32974 | High | 8.6 | 2026-03-29 | OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey… |
CVE-2026-33895 | High | 7.5 | 2026-03-27 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification a… |
CVE-2026-33894 | High | 7.5 | 2026-03-27 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature ver… |
CVE-2026-33487 | High | 7.5 | 2026-03-26 | goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in `validate.go` goes through the referenc… |
CVE-2026-20699 | Medium | 6.2 | 2026-03-25 | A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.5, mac… |
CVE-2026-4600 | High | 7.4 | 2026-03-23 | Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in K… |
CVE-2026-4115 | Low | 3.7 | 2026-03-22 | A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the component Ed25519 Signature Handler. The… |
CVE-2026-4541 | Low | 2.5 | 2026-03-22 | A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component E… |
CVE-2026-4478 | High | 8.1 | 2026-03-20 | A vulnerability was identified in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This impacts an unknown function of the file home/web/ipc of the compone… |
CVE-2026-32294 | Medium | 4.7 | 2026-03-17 | JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the… |
CVE-2026-3564 | Critical | 9.0 | 2026-03-17 | A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unaut… |
CVE-2026-4258 | High | 7.5 | 2026-03-17 | Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.e… |
CVE-2026-27962 | Critical | 9.1 | 2026-03-16 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implem… |
CVE-2026-3562 | High | 8.8 | 2026-03-16 | Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2026-32614 | High | 7.5 | 2026-03-16 | Go ShangMi (Commercial Cryptography) Library (GMSM) is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/S… |
CVE-2026-21002 | Medium | 5.5 | 2026-03-16 | Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary application. |
CVE-2026-20997 | Critical | 9.8 | 2026-03-16 | Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication. |
CVE-2026-20989 | Low | 2.4 | 2026-03-16 | Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font. |
CVE-2025-52648 | Medium | 4.8 | 2026-03-16 | HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered image… |
CVE-2026-32597 | High | 7.5 | 2026-03-13 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11… |
CVE-2026-28432 | High | 7.5 | 2026-03-10 | Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature… |
CVE-2025-41767 | High | 7.2 | 2026-03-09 | A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web in… |
CVE-2026-3706 | Low | 3.7 | 2026-03-08 | A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. T… |
CVE-2026-28802 | Critical | 9.8 | 2026-03-06 | Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malic… |
CVE-2026-29000 | Critical | 9.1 | 2026-03-04 | pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allo… |
CVE-2026-2746 | Medium | 5.3 | 2026-03-04 | SEPPmail Secure Email Gateway before version 15.0.1 does not properly communicate PGP signature verification results, leaving users unable to detect forged ema… |
CVE-2026-27445 | Medium | 5.3 | 2026-03-04 | SEPPmail Secure Email Gateway before version 15.0.1 does not properly verify that a PGP signature was generated by the expected key, allowing signature spoofin… |
CVE-2025-15598 | Low | 3.7 | 2026-03-03 | A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the… |
CVE-2026-3338 | High | 7.5 | 2026-03-02 | Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Au… |
CVE-2025-12150 | Low | 3.1 | 2026-02-27 | A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register… |
CVE-2026-22866 | High | 7.5 | 2026-02-25 | Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. In versions 1.6.2 and prior, the `RSASHA256A… |
CVE-2026-2968 | Low | 3.7 | 2026-02-23 | A vulnerability was detected in Cesanta Mongoose up to 7.20. This impacts the function mg_chacha20_poly1305_decrypt of the file /src/tls_chacha20.c of the comp… |
CVE-2025-32060 | Medium | 6.7 | 2026-02-15 | The system suffers from the absence of a kernel module signature verification. If an attacker can execute commands on behalf of root user (due to additional vu… |
CVE-2026-25922 | High | 8.8 | 2026-02-12 | authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signa… |
CVE-2026-23687 | High | 8.8 | 2026-02-10 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modif… |
CVE-2026-1529 | High | 8.1 | 2026-02-09 | A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token… |
CVE-2026-25793 | High | 8.1 | 2026-02-06 | Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is po… |
CVE-2026-1568 | Critical | 9.6 | 2026-02-03 | Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attac… |
CVE-2026-0750 | High | 7.5 | 2026-01-28 | Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This… |
CVE-2026-1237 | | 2026-01-28 | Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database recor… | |
CVE-2026-24850 | Medium | 5.3 | 2026-01-28 | The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in version 0.0.4 and prior to version 0.1.0… |
CVE-2025-15469 | Medium | 5.5 | 2026-01-27 | Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of… |
CVE-2026-24807 | | 2026-01-27 | Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/a… | |
CVE-2026-22696 | | 2026-01-26 | dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present in versions prior to 0.3.9 involves a c… | |
CVE-2026-23992 | Medium | 5.9 | 2026-01-22 | go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repositor… |