In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.
CVE-2026-103297 is a high-severity vulnerability in Adobe Content Credentials Rust SDK caused by improper verification of cryptographic signatures. This flaw could allow an attacker to bypass security features and gain unauthorized write access without requiring user interaction.
CVE-2026-103296 is a high-severity vulnerability in Adobe Content Credentials Rust SDK involving improper verification of cryptographic signatures. This flaw allows an attacker to bypass security features and gain unauthorized write access without requiring user interaction.
CVE-2026-95633 is a high-severity vulnerability in Adobe Content Credentials Rust SDK caused by improper verification of cryptographic signatures. This flaw allows an attacker to bypass security features and gain unauthorized write access without requiring user interaction.
CVE-2026-102502 is a medium severity vulnerability in Adobe Content Credentials Rust SDK involving improper verification of cryptographic signatures. This flaw could allow an attacker to bypass security features and gain unauthorized limited write access without requiring user interaction.
CVE-2026-95632 is a high-severity vulnerability in Adobe Content Credentials Rust SDK caused by improper verification of cryptographic signatures. This flaw allows an attacker to bypass security features and gain unauthorized write access without requiring user interaction.
CVE-2026-97799 is a high-severity vulnerability in Microsoft Windows 11 Version 24H2 affecting the Windows Audio Service. It involves improper verification of cryptographic signatures, which could allow an authorized local attacker to elevate privileges. The issue is fixed in specific patched versions of Windows 11 24H2.
CVE-2026-96957 is a high-severity vulnerability in the Microsoft .NET 10.0 runtime involving improper verification of cryptographic signatures. This flaw allows an unauthorized attacker to bypass a security feature remotely over a network. The issue affects multiple versions of the .NET runtime prior to their respective fixed releases. Official patches have been released to address this vulnerability.
CVE-2026-96252 is a critical vulnerability in Microsoft Windows 10 Version 1607 and related versions involving improper verification of cryptographic signatures in Active Directory Federation Services (AD FS). This flaw allows an unauthorized attacker to perform spoofing attacks over a network. The vulnerability affects multiple Windows versions prior to specific fixed builds. An official fix is available from Microsoft.
CVE-2026-87696 is a high-severity vulnerability in Microsoft Exchange Server 2016 Cumulative Update 23 involving improper verification of cryptographic signatures. This flaw allows an authorized attacker to elevate privileges over a network. The vulnerability affects multiple versions prior to specific fixed releases. An official fix is available from Microsoft.
CVE-2026-70071 is a vulnerability in Microsoft Windows 10 Version 1607 DNS Server involving improper verification of cryptographic signatures. This flaw allows an authorized local attacker to tamper with DNS Server operations. The issue affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for all affected versions. The vulnerability has a medium severity rating with a CVSS score of 5.5 and does not require user interaction for exploitation.
CVE-2026-85818 is a critical vulnerability in Microsoft Windows 11 version 23H2 involving improper verification of cryptographic signatures in the Schannel component. This flaw allows an unauthorized attacker to perform network spoofing attacks. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. Microsoft has released official patches to address this issue.
CVE-2026-83798 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds involving improper verification of cryptographic signatures in the Windows Update Stack. This flaw allows a local authorized attacker to perform spoofing attacks by exploiting the signature verification weakness. The issue affects multiple Windows 10 builds prior to their respective fixed versions. Microsoft has released official fixes for all affected versions.
CVE-2026-69650 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 involving improper verification of cryptographic signatures in the Windows Key Distribution Center. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple specific builds of Windows 10 and earlier Windows versions, with fixes available in later updates.
CVE-2026-102866 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition involving improper verification of cryptographic signatures. This flaw allows an unauthorized attacker to elevate privileges over a network. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20190. An official fix is available in version 16.0.20326.20190.
CVE-2026-65197 is a vulnerability in H3C HDM Family-A G5 firmware verification. The device verifies RSA signatures of firmware images against a public key stored in a mutable file `/conf/public.pem`. This file can be overwritten by an authenticated Redfish client with firmware-update privileges, allowing replacement of the trust anchor with an attacker-controlled key. Without a hardware root-of-trust, malicious firmware signed with the substituted key can pass verification. This affects versions up to and including 6.14.01.
Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 contain an improper authentication vulnerability in SAML processing. This flaw allows an unauthenticated remote attacker to cause the server to accept a SAML assertion that should be rejected, potentially leading to unauthorized access. The vulnerability has a high severity rating with a CVSS score of 7.5 and impacts the integrity of the system without affecting confidentiality or availability.
CVE-2026-103902 is a high-severity vulnerability in DigiDoc's libdigidocpp and related DigiDoc applications for Android and iOS. It involves improper verification of cryptographic signatures, allowing attackers to forge digital signatures that affected DigiDoc software incorrectly validates as legitimate. This flaw affects multiple versions of libdigidocpp, DigiDoc4, DigiDoc Android, and DigiDoc iOS.