By weakness (CWE)

CWE-354: related vulnerabilities

CVEs classified under CWE-354. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-8720HIGH 7.5

  wolfSSL's HMAC-BLAKE2 implementation contains a critical flaw where oversized cryptographic keys cause the authentication mechanism to ignore the actual message content. When a key exceeds BLAKE2's block size, the library discards previously accumulated message data and resets its internal state, resulting in a message authentication code (MAC) that depends only on the key—not on what is being authenticated. This means an attacker could substitute arbitrary data and still produce a valid MAC if they know or control the key, fundamentally breaking message authentication for affected implementations. The vulnerability is confined to HMAC-BLAKE2 APIs introduced in wolfSSL 5.9.0 and later.

• CVE-2026-34181HIGH 7.4

  OpenSSL's PKCS#12 file parser has a validation flaw that allows attackers to forge certificates and private keys. When a service uses PKCS#12 files with password-based authentication (specifically the PBMAC1 integrity mechanism), an attacker can craft a specially designed file that bypasses validation checks with a 1-in-256 success rate. This means an attacker could inject malicious certificates and keys into systems that process these files, potentially enabling account impersonation and unauthorized access.

• CVE-2026-50021MEDIUM 6.8

  pnpm, a widely-used Node.js package manager, has a gap in its integrity verification logic. When a lockfile entry is missing an integrity checksum, pnpm will install the package without validating that its contents match what was originally locked. An attacker who can modify your lockfile and redirect package downloads to a compromised registry can inject altered code into your dependencies—even when you run pnpm install --frozen-lockfile, which is intended to be a safe, reproducible install. Unlike npm's ci command, which always enforces integrity checks, pnpm silently skips verification if the checksum is absent, creating a dangerous fail-open behavior.

• CVE-2026-48028MEDIUM 6.5

  Mastodon, the popular open-source social network platform, has a vulnerability in how it validates incoming messages signed with digital signatures. An attacker can manipulate these signed messages by removing certain data fields while keeping the signature valid, effectively impersonating another user or system. This could allow spoofing of activities—like posts or follows—that appear to come from legitimate sources but have been altered by an attacker. The vulnerability affects multiple versions of Mastodon and has been patched in versions 4.5.10, 4.4.17, and 4.3.23.

• CVE-2026-50128MEDIUM 5.3

  Mastodon, the open-source social network platform, contains a vulnerability in how it validates author attribution claims on posts. Attackers can forge or modify claims about where an article originated without being detected by Mastodon's signature verification system. This affects versions 4.3.0 through 4.5.10 (4.5.x line) and 4.4.0 through 4.4.17 (4.4.x line). The flaw lies in a JSON-LD configuration error that weakens cryptographic signing, allowing an attacker to tamper with authorship metadata on legitimately signed updates.