https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 22:45:32 +0000 https://cve.radiocsirt.org/vuln/cve-2026-40070 <p><strong>Affected:</strong> sgbett bsv-ruby-sdk, sgbett bsv-sdk, sgbett bsv-wallet</p> <p>BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier&#39;s signature over the certificate contents. In acquisition_protocol: &#39;direct&#39;, the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: &#39;issuance&#39;, the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certificates and prove_certificate.</p> <p><strong>Affected:</strong> sgbett bsv-ruby-sdk, sgbett bsv-sdk, sgbett bsv-wallet</p> <p>BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier&#39;s signature over the certificate contents. In acquisition_protocol: &#39;direct&#39;, the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: &#39;issuance&#39;, the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certificates and prove_certificate.</p> https://cve.radiocsirt.org/vuln/cve-2026-40070