agentprime: CWE-354

CVE-2026-107846: bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

Wed, 04 Nov 2026 19:02:39 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Forge: AES-GCM authentication bypass via unvalidated tagLength option

Fri, 30 Oct 2026 23:02:09 GMT

node-forge <1.4.1, fixed in 1.4.1. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

Fri, 30 Oct 2026 23:02:05 GMT

node-forge <1.4.1, fixed in 1.4.1. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-118776: Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

Thu, 29 Oct 2026 18:37:32 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

zip: AES Entry HMAC Authentication Bypass on Premature EOF

Thu, 29 Oct 2026 16:40:07 GMT

zip >=0.6.0, <9.0.0, fixed in 9.0.0. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-90720: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8…

Wed, 28 Oct 2026 08:32:31 GMT

CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116608: DAMO Academy VideoLLaMA2 Model Loading init.py load_pretrained_model integrity check

Tue, 27 Oct 2026 00:15:18 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose

Mon, 26 Oct 2026 19:52:54 GMT

jose >=1.2.0, <1.11.13, fixed in 1.11.13. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

virtualenv: Downloaded wheel selection and caching precede verification

Fri, 23 Oct 2026 22:25:22 GMT

virtualenv <21.14.9, fixed in 21.14.9. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-89320: HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

Fri, 23 Oct 2026 08:56:20 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-35501: Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.

Wed, 21 Oct 2026 08:56:55 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85243: Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure

Mon, 19 Oct 2026 10:32:21 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Thu, 15 Oct 2026 20:22:02 GMT

github.com/distribution/distribution/v3 <3.1.2, fixed in 3.1.2. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-109366: Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height

Mon, 12 Oct 2026 16:05:43 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-105280: Hex writes unverified package tarballs to standard output in mix hex.package fetch

Mon, 12 Oct 2026 15:30:14 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Checksum database bypass for golang.org/toolchain in cmd/go

Thu, 08 Oct 2026 22:31:09 GMT

toolchain <1.26.9 || >=1.27.0-0, <1.27.2, fixed in 1.26.9, 1.27.2. CVSS 7.8 (High). Published by OSV. Not analysed by agentprime yet.

Checksum bypass for golang.org/fips140 in cmd/go

Thu, 08 Oct 2026 22:31:09 GMT

toolchain <1.26.9 || >=1.27.0-0, <1.27.2, fixed in 1.26.9, 1.27.2. CVSS 7.8 (High). Published by OSV. Not analysed by agentprime yet.

CVE-2026-106434: Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt

Thu, 08 Oct 2026 18:56:43 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-84900: HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates

Mon, 05 Oct 2026 20:28:48 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-93318: Cache poisoning via unvalidated image layer DiffIDs

Mon, 05 Oct 2026 17:45:39 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-93317: Container blob cache can accept unverified content

Mon, 05 Oct 2026 17:43:44 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-71888: CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent

Sat, 03 Oct 2026 08:36:12 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85515: OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

Sat, 03 Oct 2026 08:05:16 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-103601: CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

Fri, 02 Oct 2026 07:09:17 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16001: IesEngine stream-mode MAC forgery via length-dependent KDF split

Fri, 02 Oct 2026 06:55:36 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15999: AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication

Fri, 02 Oct 2026 06:52:16 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102759: NetX Secure TLS accepts an empty application-data record without verifying its message authentication code.

Tue, 29 Sep 2026 17:28:04 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-95625: Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade

Wed, 23 Sep 2026 08:51:53 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-92701: Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path

Fri, 18 Sep 2026 17:06:18 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54578: mport verify can compare stale checksum data after hashing failures

Thu, 17 Sep 2026 16:54:20 GMT

CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54580: mport index decompression can leave partial or corrupt index data after zstd failures

Thu, 17 Sep 2026 16:51:29 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73459: Security Advisory 0160

Tue, 15 Sep 2026 23:16:27 GMT

CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-76852: Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write

Tue, 15 Sep 2026 21:57:48 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-72929: Windows Installer Elevation of Privilege Vulnerability

Tue, 08 Sep 2026 17:12:33 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-20354: Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty

Wed, 02 Sep 2026 16:14:29 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-82549: Linux Foundation Magma SecurityModeComplete integrity check

Sun, 30 Aug 2026 15:30:09 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-61480: An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the…

Wed, 26 Aug 2026 00:00:00 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-75803: AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Tue, 25 Aug 2026 13:00:25 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-75625: Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass

Tue, 18 Aug 2026 17:56:54 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12817: OpenPGP AEAD decryption skips final tag on chunk-aligned data

Mon, 03 Aug 2026 02:54:16 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12816: IESEngine stream-mode MAC forgery via length-dependent KDF split

Mon, 03 Aug 2026 02:53:32 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12803: KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)

Mon, 03 Aug 2026 02:52:20 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12802: CMS AuthEnvelopedData fails to enforce tag-length on decryption

Mon, 03 Aug 2026 02:48:42 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-58061: CCM-family modes write plaintext to caller buffer before tag check

Mon, 03 Aug 2026 02:36:36 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59642: CMS AuthenticatedData content not bound to MAC when authAttrs present

Mon, 03 Aug 2026 00:53:28 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

Wed, 22 Jul 2026 13:10:24 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16317: Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Tue, 21 Jul 2026 20:12:48 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-13385: Improper certificate validation in ASUS Router

Wed, 15 Jul 2026 02:01:46 GMT

CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-9653: 1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID

Tue, 14 Jul 2026 15:00:06 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

melange: Incomplete package integrity verification allows data section substitution

Fri, 10 Jul 2026 21:43:05 GMT

chainguard.dev/apko <1.2.9, fixed in 1.2.9. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

agentprime: CWE-354

CVE-2026-107846: bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

Forge: AES-GCM authentication bypass via unvalidated tagLength option

Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

CVE-2026-118776: Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

zip: AES Entry HMAC Authentication Bypass on Premature EOF

CVE-2026-90720: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8…

CVE-2026-116608: DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check

Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose

virtualenv: Downloaded wheel selection and caching precede verification

CVE-2026-89320: HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

CVE-2026-35501: Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.

CVE-2026-85243: Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure

Distribution: Client `manifests.Get()` does not verify returned content against requested digest

CVE-2026-109366: Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height

CVE-2026-105280: Hex writes unverified package tarballs to standard output in mix hex.package fetch

Checksum database bypass for golang.org/toolchain in cmd/go

Checksum bypass for golang.org/fips140 in cmd/go

CVE-2026-106434: Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt

CVE-2026-84900: HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates

CVE-2026-93318: Cache poisoning via unvalidated image layer DiffIDs

CVE-2026-93317: Container blob cache can accept unverified content

CVE-2026-71888: CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent

CVE-2026-85515: OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

CVE-2026-103601: CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

CVE-2026-16001: IesEngine stream-mode MAC forgery via length-dependent KDF split

CVE-2026-15999: AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication

CVE-2026-102759: NetX Secure TLS accepts an empty application-data record without verifying its message authentication code.

CVE-2026-95625: Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade

CVE-2026-92701: Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path

CVE-2026-54578: mport verify can compare stale checksum data after hashing failures

CVE-2026-54580: mport index decompression can leave partial or corrupt index data after zstd failures

CVE-2026-73459: Security Advisory 0160

CVE-2026-76852: Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write

CVE-2026-72929: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-20354: Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty

CVE-2026-82549: Linux Foundation Magma SecurityModeComplete integrity check

CVE-2025-61480: An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the…

CVE-2026-75803: AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

CVE-2026-75625: Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass

CVE-2026-12817: OpenPGP AEAD decryption skips final tag on chunk-aligned data

CVE-2026-12816: IESEngine stream-mode MAC forgery via length-dependent KDF split

CVE-2026-12803: KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)

CVE-2026-12802: CMS AuthEnvelopedData fails to enforce tag-length on decryption

CVE-2026-58061: CCM-family modes write plaintext to caller buffer before tag check

CVE-2026-59642: CMS AuthenticatedData content not bound to MAC when authAttrs present

CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

CVE-2026-16317: Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

CVE-2026-13385: Improper certificate validation in ASUS Router

CVE-2026-9653: 1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID

melange: Incomplete package integrity verification allows data section substitution

CVE-2026-116608: DAMO Academy VideoLLaMA2 Model Loading init.py load_pretrained_model integrity check