Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-129092

CCC Attestation SIG attested-tls-poc through commit 731ca82 TOCTOU via Handshake-Only Attestation

CCC Attestation SIG attested-tls-poc through commit 731ca82 contains a time-of-check time-of-use vulnerability because Evidence is appraised only once during the TLS handshake, without post-handshake re-attestation. Attackers with local access to the attesting endpoint can alter workload code, data, configuration, or attached devices like GPUs while peers keep trusting the original Evidence.

CVSS 4.0 · 7 High EPSS n/a KEV · Not listed
Vendors
Ccc-attestation
Products
Attested-tls-poc
CVE-2026-112377

CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ccc-attestation
Products
Attested-tls-poc