Alertas de Seguridad de la Información

J Alto vulnerabilidad

27/07/2026

[CVE-2026-65616] Incorrect authorization validation in refresh token signature allows non-admin users to obtain a sig…

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-14837] Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH …

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13089] OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token…

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64623] Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in …

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain signed permission-grant tokens for sensitive resources including SHELL_EXEC.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-49998] Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic…

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwk…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-48815] sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, th…

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized cer…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47304] Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a…

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54783] CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior …

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and supporting signature verification does not ensure the selected ds:Signature covers the expected Security header target, allowing an attacker with one captured signed SOAP envelope to replay arbitrary service operations as the victim principal. Th…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54774] CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior …

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureValue verification when a CoreWCF service validates SAML tokens using a non-X.509 signing token, allowing an attacker to reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification. This issue is fixed in vers…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-11348] Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fak…

Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affects Liman MYS: before release.Master.1107.

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

02/07/2026

[CVE-2026-50721] Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the …

Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to …

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

02/07/2026

[CVE-2026-50722] Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verif…

Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a …

nvdaltovulnerabilidad CVSS 8.1 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-6331] HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as …

HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path the supplied signature length was only checked as not exceeding the MAC length, so a zero-length or otherwise truncated tag could pass verification. The fix requires the supplied tag length to exactly equal the MAC length …

nvdaltovulnerabilidad CVSS 7.5 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-7511] PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature…

PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a forged signature to be accepted.

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-11800] A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Gr…

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized acces…

nvdaltovulnerabilidad CVSS 8.1 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-55961] wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains n…

wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path now rejects the object when no signer signature has actually been verified, so a PKCS#7 carrying no valid signature is no longer…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/06/2026

[CVE-2026-9779] ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Exec…

ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateWar method. The issue results from an incorrect implementation of c…

nvdaltovulnerabilidad CVSS 7.2 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-50010] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by dis…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-10795] The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication B…

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a p…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42462] Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to v…

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions …

nvdaltovulnerabilidad CVSS 7.0 NVD