https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:56:02.909627+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2022-avi-767 certfr-2022-avi-767 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T20:56:03.047436+00:00 certfr-2022-avi-767 https://cve.radiocsirt.org/vuln/cnvd-2022-22657 cnvd-2022-22657 2026-10-02T20:56:03.047481+00:00 cnvd-2022-22657 https://cve.radiocsirt.org/vuln/euvd-2026-234302 EUVD-2026-234302 2026-10-02T20:56:03.047497+00:00 EUVD-2026-234302 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24772 fkie_cve-2022-24772 2026-10-02T20:56:03.047509+00:00

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

 https://cve.radiocsirt.org/vuln/ghsa-x4jg-mjrx-434g GHSA-x4jg-mjrx-434g — Improper Verification of Cryptographic Signature in node-forge 2026-10-02T20:56:03.047539+00:00

Affected: npm: node-forge

### Impact

RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used.

### Patches

The issue has been addressed in `node-forge` `1.3.0`.

### References

For more information, please see ["Bleichenbacher's RSA signature forgery based on implementation error"](https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE/) by Hal Finney.

### For more information

If you have any questions or comments about this advisory: * Open an issue in [forge](https://github.com/digitalbazaar/forge) * Email us at [example email address](mailto:security@digitalbazaar.com)

 https://cve.radiocsirt.org/vuln/gsd-2022-24772 gsd-2022-24772 2026-10-02T20:56:03.047571+00:00 gsd-2022-24772 https://cve.radiocsirt.org/vuln/rhsa-2022:1681 RHSA-2022:1681 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes 2026-10-02T20:56:03.047582+00:00

vm2: vulnerable to Sandbox Bypass golang.org/x/crypto: empty plaintext packet causes panic follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak urijs: Authorization Bypass Through User-Controlled Key cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor nconf: Prototype pollution in memory store nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account urijs: Leading white space bypasses protocol validation node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery node-forge: Signature verification leniency in checking `DigestInfo` structure Moment.js: Path traversal in moment.locale

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-24772 UBUNTU-CVE-2022-24772 2026-10-02T20:56:03.047623+00:00

Affected: Ubuntu:20.04:LTS: node-node-forge, Ubuntu:22.04:LTS: node-node-forge

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0417 WID-SEC-W-2022-0417 — Red Hat OpenShift Service Mesh: Mehrere Schwachstellen 2026-10-02T20:56:03.047646+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh ausnutzen, um Dateien zu manipulieren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.