CWE-347
CVEs classified under CWE-347, newest first.
311 CVEsRSS
CVE-2026-109838Medium· 5.1IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
CVE-2026-102946Critical· 9.1PoCjoserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures …
CVE-2026-110765Medium· 5.9FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment…
CVE-2026-95633High· 7.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain u…
CVE-2026-95632High· 7.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain u…
CVE-2026-103297High· 7.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain u…
CVE-2026-103296High· 7.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain u…
CVE-2026-102502Medium· 5.3CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain u…
CVE-2026-97799High· 7.8Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.
Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96957High· 8.8Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96252Critical· 9.1Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-87696High· 7.5Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-85818Critical· 9.0Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-83798Medium· 5.5Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.
Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.
CVE-2026-70071Medium· 5.5Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally.
Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally.
CVE-2026-69650High· 7.8Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.
Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.
CVE-2026-102866High· 8.1Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-65197Low· 3.1H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` ac…
CVE-2026-108971Critical· 9.6PoCA flaw has been found in D-Link DCS-930L B1.08B4
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to impr…
CVE-2026-85962High· 7.5Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker co…
CVE-2026-103902High· 7.5Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS
Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that ar…
CVE-2026-108699Medium· 6.5PoChyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers …
CVE-2026-106581High· 8.2Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed…
CVE-2026-86405Critical· 9.8Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS…
CVE-2026-85531Critical· 9.8Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Mod…
CVE-2026-103329Medium· 5.3The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated atta…
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated atta…
CVE-2026-107724High· 7.4PoCfast-jwt provides fast JSON Web Token (JWT) implementation
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetr…
CVE-2026-107722Critical· 9.8PoCfast-jwt provides fast JSON Web Token (JWT) implementation
fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDe…
CVE-2026-107720High· 7.4PoCfast-jwt provides fast JSON Web Token (JWT) implementation
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepar…
CVE-2026-84271High· 7.8IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.