Monthly
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of message integrity during decryption. An unauthenticated remote attacker who achieves a machine-in-the-middle position between email gateways can intercept and manipulate encrypted messages in transit, causing the decryption process to yield recoverable plaintext. No public exploit code or active exploitation has been identified at time of analysis, but confidentiality impact is rated High given complete plaintext disclosure.
Improper integrity check validation in Linux Foundation Magma 1.9.0's SecurityModeComplete Handler allows remote unauthenticated attackers to bypass NAS-layer security verification in the mobile core network. The SecurityModeComplete message is part of the LTE Non-Access Stratum security negotiation procedure; failure to validate the integrity check value (CWE-354) means crafted messages can be accepted without proper cryptographic verification. A publicly available proof-of-concept exists on GitHub, and the CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation with low-level impact across confidentiality, integrity, and availability dimensions.
AEAD authentication bypass in OpenSSL 3.0-4.0 lets attackers forge valid empty-ciphertext/tag pairs when applications encrypt or decrypt via the low-level EVP_Cipher() path with AES-OCB or ChaCha20-Poly1305. A zero-length cipher update was short-circuited to return success without producing or verifying the authentication tag, breaking the integrity guarantee that AEAD is supposed to provide. No public exploit is identified at time of analysis and EPSS is low (0.12%), but the flaw is confirmed and patched by the OpenSSL project and Ubuntu.
Cache poisoning in Uber Kraken, an open-source peer-to-peer Docker registry, allows malicious peers or on-path attackers to inject attacker-chosen container image layers and manifests into the content-addressable cache. Because agents validate downloaded pieces only with CRC32 checksums - which are trivially forgeable - and never confirm the reassembled blob against its requested SHA-256 digest before commit, substituted content is accepted, re-seeded to the swarm, and executed by other hosts, yielding fleet-wide integrity compromise and downstream code execution. No public exploit identified at time of analysis; the issue is tracked in vendor GitHub issue #638 and a VulnCheck advisory, with a CVSS 4.0 base score of 9.1.
OpenPGP AEAD decryption in Bouncy Castle for Java silently bypasses the final authentication tag when plaintext is an exact multiple of the AEAD chunk length, allowing an attacker who can tamper with ciphertext to strip trailing plaintext chunks and have the truncated message accepted as cryptographically authentic. Affected libraries span bc-java before 1.85, bc-lts-java before 2.73.12, and all three active BC-FJA FIPS series before their respective bcpg-fips 1.0.13, 2.0.13, and 2.1.13 releases. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 (Integrity: High) reflects a complete and silent bypass of AEAD integrity guarantees for chunk-aligned messages with no downstream exception or warning.
IESEngine in Bouncy Castle for Java allows cross-message MAC forgery when stream mode is used with static key pairs, affecting bc-java before 1.85 and bc-lts-java before 2.73.12. The flaw stems from a length-dependent KDF output split: in the static-key path (no ephemeral V component), the MAC key K2 was placed at a byte offset equal to the message length after the keystream K1, so an observer of one known-plaintext encryption can recover K2 and forge valid ciphertext-plus-tag pairs for shorter messages. No public exploit beyond the vendor's own proof-of-concept regression test exists, and no CISA KEV listing is present at time of analysis.
Cross-nonce AEAD forgery in Bouncy Castle for Java's KCCMBlockCipher (DSTU 7624 CCM mode) allows an attacker with chosen-plaintext oracle access to forge valid authenticated ciphertext under an un-queried nonce when no associated authenticated data is present. All bc-java releases before 1.85 and bc-lts-java releases before 2.73.12 are affected. The G1 initialization block - which binds the nonce into the MAC under the DSTU 7624:2014 standard - was conditionally skipped when no AAD bytes were supplied, leaving the authentication tag independent of the nonce and breaking the core AEAD security guarantee. No public exploit has been independently released and this vulnerability is not listed in CISA KEV, though the fix commits include a working regression test that fully demonstrates the forgery technique.
CMS AuthEnvelopedData decryption in Bouncy Castle for Java fails to enforce a minimum AEAD authentication tag length, allowing a network attacker to supply a crafted CMS message carrying a truncated AES-GCM/CCM ICV (e.g., 32 bits instead of the standard 128 bits), effectively reducing the authentication space to the point where tag forgery becomes computationally feasible. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and all bc-fja (FIPS) 1.0.x/2.0.x/2.1.x series before their respective .12 patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with VI:H reflects the high integrity impact of bypassing authenticated encryption guarantees.
CCMBlockCipher in Bouncy Castle for Java decrypts ciphertext directly into the caller-supplied output buffer before verifying the authentication tag, leaving unverified CTR-decrypted plaintext in memory when tag verification fails and violating NIST SP 800-38C §6.2. Every edition - bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA across three active release lines (1.0.x, 2.0.x, 2.1.x) - is affected. Applications that reuse pooled byte buffers, log failure-path output, or otherwise expose the buffer on an authentication failure inadvertently become CTR decryption oracles, allowing attackers to submit forged ciphertexts and recover plaintext without possessing a valid authentication tag. No public exploit and no CISA KEV listing exist at time of analysis.
CMS AuthenticatedData integrity verification in Bouncy Castle for Java is bypassable when authenticated attributes (authAttrs) are present, allowing an attacker to substitute arbitrary content while the recipient MAC check passes without error. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA across the 1.0.x, 2.0.x, and 2.1.x series - all widely deployed in Java enterprise and FIPS environments. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VI:H) reflects unauthenticated remote exploitation with high integrity impact; no public exploit or CISA KEV listing is confirmed at time of analysis.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of message integrity during decryption. An unauthenticated remote attacker who achieves a machine-in-the-middle position between email gateways can intercept and manipulate encrypted messages in transit, causing the decryption process to yield recoverable plaintext. No public exploit code or active exploitation has been identified at time of analysis, but confidentiality impact is rated High given complete plaintext disclosure.
Improper integrity check validation in Linux Foundation Magma 1.9.0's SecurityModeComplete Handler allows remote unauthenticated attackers to bypass NAS-layer security verification in the mobile core network. The SecurityModeComplete message is part of the LTE Non-Access Stratum security negotiation procedure; failure to validate the integrity check value (CWE-354) means crafted messages can be accepted without proper cryptographic verification. A publicly available proof-of-concept exists on GitHub, and the CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation with low-level impact across confidentiality, integrity, and availability dimensions.
AEAD authentication bypass in OpenSSL 3.0-4.0 lets attackers forge valid empty-ciphertext/tag pairs when applications encrypt or decrypt via the low-level EVP_Cipher() path with AES-OCB or ChaCha20-Poly1305. A zero-length cipher update was short-circuited to return success without producing or verifying the authentication tag, breaking the integrity guarantee that AEAD is supposed to provide. No public exploit is identified at time of analysis and EPSS is low (0.12%), but the flaw is confirmed and patched by the OpenSSL project and Ubuntu.
Cache poisoning in Uber Kraken, an open-source peer-to-peer Docker registry, allows malicious peers or on-path attackers to inject attacker-chosen container image layers and manifests into the content-addressable cache. Because agents validate downloaded pieces only with CRC32 checksums - which are trivially forgeable - and never confirm the reassembled blob against its requested SHA-256 digest before commit, substituted content is accepted, re-seeded to the swarm, and executed by other hosts, yielding fleet-wide integrity compromise and downstream code execution. No public exploit identified at time of analysis; the issue is tracked in vendor GitHub issue #638 and a VulnCheck advisory, with a CVSS 4.0 base score of 9.1.
OpenPGP AEAD decryption in Bouncy Castle for Java silently bypasses the final authentication tag when plaintext is an exact multiple of the AEAD chunk length, allowing an attacker who can tamper with ciphertext to strip trailing plaintext chunks and have the truncated message accepted as cryptographically authentic. Affected libraries span bc-java before 1.85, bc-lts-java before 2.73.12, and all three active BC-FJA FIPS series before their respective bcpg-fips 1.0.13, 2.0.13, and 2.1.13 releases. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 (Integrity: High) reflects a complete and silent bypass of AEAD integrity guarantees for chunk-aligned messages with no downstream exception or warning.
IESEngine in Bouncy Castle for Java allows cross-message MAC forgery when stream mode is used with static key pairs, affecting bc-java before 1.85 and bc-lts-java before 2.73.12. The flaw stems from a length-dependent KDF output split: in the static-key path (no ephemeral V component), the MAC key K2 was placed at a byte offset equal to the message length after the keystream K1, so an observer of one known-plaintext encryption can recover K2 and forge valid ciphertext-plus-tag pairs for shorter messages. No public exploit beyond the vendor's own proof-of-concept regression test exists, and no CISA KEV listing is present at time of analysis.
Cross-nonce AEAD forgery in Bouncy Castle for Java's KCCMBlockCipher (DSTU 7624 CCM mode) allows an attacker with chosen-plaintext oracle access to forge valid authenticated ciphertext under an un-queried nonce when no associated authenticated data is present. All bc-java releases before 1.85 and bc-lts-java releases before 2.73.12 are affected. The G1 initialization block - which binds the nonce into the MAC under the DSTU 7624:2014 standard - was conditionally skipped when no AAD bytes were supplied, leaving the authentication tag independent of the nonce and breaking the core AEAD security guarantee. No public exploit has been independently released and this vulnerability is not listed in CISA KEV, though the fix commits include a working regression test that fully demonstrates the forgery technique.
CMS AuthEnvelopedData decryption in Bouncy Castle for Java fails to enforce a minimum AEAD authentication tag length, allowing a network attacker to supply a crafted CMS message carrying a truncated AES-GCM/CCM ICV (e.g., 32 bits instead of the standard 128 bits), effectively reducing the authentication space to the point where tag forgery becomes computationally feasible. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and all bc-fja (FIPS) 1.0.x/2.0.x/2.1.x series before their respective .12 patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with VI:H reflects the high integrity impact of bypassing authenticated encryption guarantees.
CCMBlockCipher in Bouncy Castle for Java decrypts ciphertext directly into the caller-supplied output buffer before verifying the authentication tag, leaving unverified CTR-decrypted plaintext in memory when tag verification fails and violating NIST SP 800-38C §6.2. Every edition - bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA across three active release lines (1.0.x, 2.0.x, 2.1.x) - is affected. Applications that reuse pooled byte buffers, log failure-path output, or otherwise expose the buffer on an authentication failure inadvertently become CTR decryption oracles, allowing attackers to submit forged ciphertexts and recover plaintext without possessing a valid authentication tag. No public exploit and no CISA KEV listing exist at time of analysis.
CMS AuthenticatedData integrity verification in Bouncy Castle for Java is bypassable when authenticated attributes (authAttrs) are present, allowing an attacker to substitute arbitrary content while the recipient MAC check passes without error. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA across the 1.0.x, 2.0.x, and 2.1.x series - all widely deployed in Java enterprise and FIPS environments. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VI:H) reflects unauthenticated remote exploitation with high integrity impact; no public exploit or CISA KEV listing is confirmed at time of analysis.