CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,467 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,467
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product legion_of_the_bouncy_castle:bc_csharp. Show all products

21 CVEs, showing 1 to 21
CVESeverityTitlePublished
CVE-2026-103604High 8.7Quadratic-time escaping when converting X.509 distinguished names to strings
Assigned by bcorg
Oct 2, 2026
CVE-2026-103603High 8.7Unbounded HSS public key level count allows huge array allocation during signature verification
Assigned by bcorg
Oct 2, 2026
CVE-2026-103602High 8.2Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts
Assigned by bcorg
Oct 2, 2026
CVE-2026-103601High 8.2CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check
Assigned by bcorg
Oct 2, 2026
CVE-2026-103600High 8.7Unbounded ASN.1 nesting depth causes process-terminating stack overflow
Assigned by bcorg
Oct 2, 2026
CVE-2026-63578High 7.1Unbounded PBE iteration count when decrypting PKCS#8 private keys
Assigned by bcorg
Oct 2, 2026
CVE-2026-63577High 8.2Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix
Assigned by bcorg
Oct 2, 2026
CVE-2026-63576High 8.2URI name constraints checked against a mis-parsed host
Assigned by bcorg
Oct 2, 2026
CVE-2026-63575High 7.1PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count
Assigned by bcorg
Oct 2, 2026
CVE-2026-63574High 8.7Unbounded allocation from OpenPGP signature and user attribute subpacket lengths
Assigned by bcorg
Oct 2, 2026
CVE-2026-63573High 8.2Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap
Assigned by bcorg
Oct 2, 2026
CVE-2026-63572High 7.1Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files
Assigned by bcorg
Oct 2, 2026
CVE-2026-63571High 8.7Attribute certificate path validation does not verify the attribute certificate's signature
Assigned by bcorg
Oct 2, 2026
CVE-2026-63570High 7.1Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links
Assigned by bcorg
Oct 2, 2026
CVE-2026-63569Critical 9.1MTI/A0 DHAgreement does not validate the peer's ephemeral value
Assigned by bcorg
Oct 2, 2026
CVE-2026-63568High 8.7Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion
Assigned by bcorg
Oct 2, 2026
CVE-2026-63567High 8.2IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)
Assigned by bcorg
Oct 2, 2026
CVE-2026-63566High 8.7DTLS handshake reassembler allocates buffer from unchecked 24-bit length
Assigned by bcorg
Oct 2, 2026
CVE-2026-16001High 8.2IesEngine stream-mode MAC forgery via length-dependent KDF split
Assigned by bcorg
Oct 2, 2026
CVE-2026-16000High 8.7KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used
Assigned by bcorg
Oct 2, 2026
CVE-2026-15999High 8.2AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication
Assigned by bcorg
Oct 2, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.