CVE-2026-101278

Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Trusted Domain Project

Products

Opendmarc

CVE-2026-102588

Moodle: csrf in xml grade import

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2026-55174

UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding

UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r" value is not cryptographically bound to the adaptor point "T". This issue has been patched in version 4.2.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Shrec

Products

Ultrafastsecp256k1

CVE-2026-103245

n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-82017

IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Igel

Products

Igel Os

CVE-2026-81717

openssl_encrypt before 1.4.9 Integrity Bypass via Added Files

openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the manifest, so files added to the drive — including a root-level autorun payload — are not detected and integrity verification still passes. Additionally, a globally constant, source-embedded KDF salt (_LEGACY_FIXED_SALT) is used to derive the drive encryption key for any drive lacking a per-drive salt file, defeating precomputation resistance and enabling an offline rainbow-table attack.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-81714

openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-81706

openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-81702

openssl_encrypt before 1.4.9 Key Substitution via Identity Load

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-81701

openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-81700

openssl_encrypt before 1.4.9 GPG Signature Verification Bypass

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-81680

openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal

openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silently removing recovery paths the owner deliberately added.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-75106

OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jhumanj Opnform

Products

Opnform Opnform

CVE-2026-74901

openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-74890

openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-74882

openssl_encrypt before 1.4.0 Insecure Default Configuration

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-74876

openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-74875

openssl_encrypt before 1.4.0 Schema Validation Bypass

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-95297

chromium-browser: chromium-browser: Missing authorization in Contextual Tasks

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95340

chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page

Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome