Início / CVEs

Base de CVEs

Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.

184 resultado(s)

Exportar esta busca: RSS · CSV · STIX

CVE-2026-110765 Média · 5.9 CWE-347 14/10/2026

FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass

FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.

CVE-2026-95633 Alta · 7.5 CWE-347 13/10/2026

CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CVE-2026-95632 Alta · 7.5 CWE-347 13/10/2026

CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CVE-2026-103297 Alta · 7.5 CWE-347 13/10/2026

CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CVE-2026-103296 Alta · 7.5 CWE-347 13/10/2026

CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CVE-2026-102502 Média · 5.3 CWE-347 13/10/2026

CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.

CVE-2026-97799 Alta · 7.8 CWE-347 13/10/2026

Windows Audio Service Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.

CVE-2026-96957 Alta · 8.8 CWE-347 13/10/2026

.NET Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-96252 Crítica · 9.1 CWE-347 13/10/2026

Active Directory Federation Services (AD FS) Spoofing Vulnerability

Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-87696 Alta · 7.5 CWE-347 13/10/2026

Microsoft Exchange Server Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-85818 Crítica · 9.0 CWE-347 13/10/2026

Windows Schannel Spoofing Vulnerability

Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-70071 Média · 5.5 CWE-347 13/10/2026

Role: DNS Server Tampering Vulnerability

Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally.

CVE-2026-69650 Alta · 7.8 CWE-347 13/10/2026

Windows Key Distribution Center Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.

CVE-2026-102866 Alta · 8.1 CWE-347 13/10/2026

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-65197 Baixa · 3.1 CWE-347 13/10/2026

H3C G3/G5 HDM Firmware Verification Key Replacement

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key. This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.

CVE-2026-103902 Alta · 7.5 CWE-347 12/10/2026

DigiDoc improper signature verification

Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.

CVE-2026-108699 Média · 6.5 CWE-347 11/10/2026

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows...

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities.

CVE-2026-106581 Alta · 7.3 CWE-347 09/10/2026

Docker Desktop for Windows installer failed to verify external packages

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.

CVE-2026-86405 Crítica · 9.8 CWE-347 09/10/2026

Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.

CVE-2026-85531 Crítica · 9.8 CWE-347 09/10/2026

Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.

CVE-2026-103329 Média · 5.3 CWE-347 09/10/2026

Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.

CVE-2026-107724 Alta · 7.4 CWE-347 08/10/2026

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.

CVE-2026-107722 Crítica · 9.8 CWE-347 08/10/2026

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.

CVE-2026-84271 Alta · 7.8 CWE-347 08/10/2026

IBM Guardium Data Protection Signature Verification Bypass

IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.

CVE-2026-14999 Alta · 7.5 CWE-347 08/10/2026

IBM DataPower Gateway Improper Verification of Cryptographic Signature

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.