PULSE
EN
FEED
ransomakira reclama a Krishnanransomakira reclama a Erowa · CH · Manufacturingransomn0n reclama a Company #132 · USransomn0n reclama a Company #131 · DEransomn0n reclama a Company #130 · USransomn0n reclama a Company #129 · USransomn0n reclama a Company #128 · USransomrhysida reclama a Juge, Napolitano, Ruli, Putfark & Pittman · Professional Servicesransompear reclama a gWorks · US · Otherransompear reclama a Palm Vascular Centers · US · Healthcareransomscarlettgroup reclama a sigsauer.com · US · Manufacturingransomdoommageddon reclama a ASLAN TEKSTİL ve KONFEKSİYON San.ve Tic. A.Ş. · TR · Manufacturingransombyod reclama a IHG Hotels & Resorts (Estate) · GB · Hospitalityransomaoqin reclama a SILIKO d.o.o. · SI · Manufacturingransomakira reclama a Krishnanransomakira reclama a Erowa · CH · Manufacturingransomn0n reclama a Company #132 · USransomn0n reclama a Company #131 · DEransomn0n reclama a Company #130 · USransomn0n reclama a Company #129 · USransomn0n reclama a Company #128 · USransomrhysida reclama a Juge, Napolitano, Ruli, Putfark & Pittman · Professional Servicesransompear reclama a gWorks · US · Otherransompear reclama a Palm Vascular Centers · US · Healthcareransomscarlettgroup reclama a sigsauer.com · US · Manufacturingransomdoommageddon reclama a ASLAN TEKSTİL ve KONFEKSİYON San.ve Tic. A.Ş. · TR · Manufacturingransombyod reclama a IHG Hotels & Resorts (Estate) · GB · Hospitalityransomaoqin reclama a SILIKO d.o.o. · SI · Manufacturing
← Todos los CVEs
CVE Watch4 nov 2026

CVE-2026-110021

PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `S

CVSS

6.2

Medio

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 4 nov 2026 · Última mod.: 4 nov 2026 · CWE-347

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1219703.7 BAJ
—
———Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.8hCVE-2026-12160610.0 CRÍ
—
——0A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.20hCVE-2026-918996.4 MED
0.4%
——0Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Arbitrary Code Execution.1dCVE-2026-918988.1 ALT
21.9%
——7Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Elevation of Privilege.1dCVE-2026-1204597.4 ALT
16.6%
——5python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.2dCVE-2026-919085.7 MED
3.1%
——1Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.1d