Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
Typeapk
Namespacealpine
Namewolfssl
Version5.9.1-r0
Qualifiers
arch armv7
distroversion edge
reponame community
Subpath
Is_vulnerablefalse
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-15fz-hhc7-kyaa
vulnerability_id VCID-15fz-hhc7-kyaa
summary wolfSSL: wolfSSL: Reduced security of ECDSA authentication via missing digest size checks
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-5194.json
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-5194.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5194
reference_id
reference_type
scores
0
value 0.00029
scoring_system epss
scoring_elements 0.08261
published_at 2026-04-18T12:55:00Z
1
value 0.00035
scoring_system epss
scoring_elements 0.10383
published_at 2026-04-13T12:55:00Z
2
value 0.00035
scoring_system epss
scoring_elements 0.10445
published_at 2026-04-11T12:55:00Z
3
value 0.00035
scoring_system epss
scoring_elements 0.10405
published_at 2026-04-12T12:55:00Z
4
value 0.00036
scoring_system epss
scoring_elements 0.10434
published_at 2026-04-16T12:55:00Z
5
value 0.0004
scoring_system epss
scoring_elements 0.12083
published_at 2026-04-21T12:55:00Z
6
value 0.0004
scoring_system epss
scoring_elements 0.1206
published_at 2026-04-24T12:55:00Z
7
value 0.0004
scoring_system epss
scoring_elements 0.12028
published_at 2026-04-26T12:55:00Z
8
value 0.0004
scoring_system epss
scoring_elements 0.11931
published_at 2026-04-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5194
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5194
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5194
3
reference_url https://github.com/wolfSSL/wolfssl/pull/10131
reference_id 10131
reference_type
scores
0
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:L/SA:L/U:Red
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-10T18:05:44Z/
url https://github.com/wolfSSL/wolfssl/pull/10131
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457041
reference_id 2457041
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457041
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5194
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-15fz-hhc7-kyaa
1
url VCID-3gve-u4f4-bkht
vulnerability_id VCID-3gve-u4f4-bkht
summary Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can trigger an OOB read on the heap. The missing bounds check is in the indefinite-length end-of-content verification loop in PKCS7_VerifySignedData().
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5392
reference_id
reference_type
scores
0
value 0.00014
scoring_system epss
scoring_elements 0.02492
published_at 2026-04-12T12:55:00Z
1
value 0.00014
scoring_system epss
scoring_elements 0.02502
published_at 2026-04-11T12:55:00Z
2
value 0.00014
scoring_system epss
scoring_elements 0.0249
published_at 2026-04-13T12:55:00Z
3
value 0.00017
scoring_system epss
scoring_elements 0.04053
published_at 2026-04-29T12:55:00Z
4
value 0.00017
scoring_system epss
scoring_elements 0.04002
published_at 2026-04-24T12:55:00Z
5
value 0.00017
scoring_system epss
scoring_elements 0.04008
published_at 2026-04-26T12:55:00Z
6
value 0.00017
scoring_system epss
scoring_elements 0.03859
published_at 2026-04-16T12:55:00Z
7
value 0.00017
scoring_system epss
scoring_elements 0.03869
published_at 2026-04-18T12:55:00Z
8
value 0.00017
scoring_system epss
scoring_elements 0.0399
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5392
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5392
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5392
2
reference_url https://github.com/wolfssl/wolfssl/pull/10039
reference_id 10039
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T14:08:38Z/
url https://github.com/wolfssl/wolfssl/pull/10039
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5392
risk_score 1.1
exploitability 0.5
weighted_severity 2.1
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3gve-u4f4-bkht
2
url VCID-4zyq-af27-yqa4
vulnerability_id VCID-4zyq-af27-yqa4
summary A 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c) during wildcard hostname validation when the LEFT_MOST_WILDCARD_ONLY flag is active. If a wildcard * exhausts the entire hostname string, the function reads one byte past the buffer without a bounds check, which could cause a crash.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5772
reference_id
reference_type
scores
0
value 0.00042
scoring_system epss
scoring_elements 0.12744
published_at 2026-04-12T12:55:00Z
1
value 0.00042
scoring_system epss
scoring_elements 0.12782
published_at 2026-04-11T12:55:00Z
2
value 0.00042
scoring_system epss
scoring_elements 0.12697
published_at 2026-04-13T12:55:00Z
3
value 0.00047
scoring_system epss
scoring_elements 0.14298
published_at 2026-04-29T12:55:00Z
4
value 0.00047
scoring_system epss
scoring_elements 0.14379
published_at 2026-04-24T12:55:00Z
5
value 0.00047
scoring_system epss
scoring_elements 0.14353
published_at 2026-04-26T12:55:00Z
6
value 0.00047
scoring_system epss
scoring_elements 0.14282
published_at 2026-04-18T12:55:00Z
7
value 0.00047
scoring_system epss
scoring_elements 0.14351
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5772
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5772
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5772
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10119
reference_id 10119
reference_type
scores
0
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T13:52:51Z/
url https://github.com/wolfSSL/wolfssl/pull/10119
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5772
risk_score 0.9
exploitability 0.5
weighted_severity 1.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4zyq-af27-yqa4
3
url VCID-75y2-h9uk-n3a6
vulnerability_id VCID-75y2-h9uk-n3a6
summary An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can specify an entry length larger than the enclosing sequence, causing the internal length counter to wrap during parsing. This results in incorrect handling of certificate data. The issue is limited to configurations using the original ASN.1 parsing implementation which is off by default.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5188
reference_id
reference_type
scores
0
value 0.00028
scoring_system epss
scoring_elements 0.07843
published_at 2026-04-12T12:55:00Z
1
value 0.00028
scoring_system epss
scoring_elements 0.07856
published_at 2026-04-11T12:55:00Z
2
value 0.00028
scoring_system epss
scoring_elements 0.0783
published_at 2026-04-13T12:55:00Z
3
value 0.00036
scoring_system epss
scoring_elements 0.10653
published_at 2026-04-29T12:55:00Z
4
value 0.00036
scoring_system epss
scoring_elements 0.10728
published_at 2026-04-24T12:55:00Z
5
value 0.00036
scoring_system epss
scoring_elements 0.10708
published_at 2026-04-26T12:55:00Z
6
value 0.00036
scoring_system epss
scoring_elements 0.10634
published_at 2026-04-16T12:55:00Z
7
value 0.00036
scoring_system epss
scoring_elements 0.1065
published_at 2026-04-18T12:55:00Z
8
value 0.00036
scoring_system epss
scoring_elements 0.10774
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5188
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5188
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5188
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10024
reference_id 10024
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T13:41:44Z/
url https://github.com/wolfSSL/wolfssl/pull/10024
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5188
risk_score 1.1
exploitability 0.5
weighted_severity 2.1
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-75y2-h9uk-n3a6
4
url VCID-9jb1-k32z-w7gw
vulnerability_id VCID-9jb1-k32z-w7gw
summary When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the application to call specific session restore APIs.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5507
reference_id
reference_type
scores
0
value 0.00016
scoring_system epss
scoring_elements 0.03696
published_at 2026-04-12T12:55:00Z
1
value 0.00016
scoring_system epss
scoring_elements 0.03718
published_at 2026-04-11T12:55:00Z
2
value 0.00016
scoring_system epss
scoring_elements 0.0367
published_at 2026-04-13T12:55:00Z
3
value 0.00021
scoring_system epss
scoring_elements 0.05945
published_at 2026-04-29T12:55:00Z
4
value 0.00021
scoring_system epss
scoring_elements 0.05713
published_at 2026-04-16T12:55:00Z
5
value 0.00021
scoring_system epss
scoring_elements 0.059
published_at 2026-04-24T12:55:00Z
6
value 0.00021
scoring_system epss
scoring_elements 0.05935
published_at 2026-04-26T12:55:00Z
7
value 0.00021
scoring_system epss
scoring_elements 0.05723
published_at 2026-04-18T12:55:00Z
8
value 0.00021
scoring_system epss
scoring_elements 0.05868
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5507
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5507
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5507
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10088
reference_id 10088
reference_type
scores
0
value 4.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T14:38:30Z/
url https://github.com/wolfSSL/wolfssl/pull/10088
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5507
risk_score 1.9
exploitability 0.5
weighted_severity 3.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9jb1-k32z-w7gw
5
url VCID-bfap-h1d9-33dj
vulnerability_id VCID-bfap-h1d9-33dj
summary A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5504
reference_id
reference_type
scores
0
value 0.00019
scoring_system epss
scoring_elements 0.05034
published_at 2026-04-12T12:55:00Z
1
value 0.00019
scoring_system epss
scoring_elements 0.05052
published_at 2026-04-11T12:55:00Z
2
value 0.00019
scoring_system epss
scoring_elements 0.05016
published_at 2026-04-13T12:55:00Z
3
value 0.00025
scoring_system epss
scoring_elements 0.06933
published_at 2026-04-29T12:55:00Z
4
value 0.00025
scoring_system epss
scoring_elements 0.06846
published_at 2026-04-16T12:55:00Z
5
value 0.00025
scoring_system epss
scoring_elements 0.0696
published_at 2026-04-24T12:55:00Z
6
value 0.00025
scoring_system epss
scoring_elements 0.06965
published_at 2026-04-26T12:55:00Z
7
value 0.00025
scoring_system epss
scoring_elements 0.06828
published_at 2026-04-18T12:55:00Z
8
value 0.00025
scoring_system epss
scoring_elements 0.06973
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5504
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5504
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5504
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10088
reference_id 10088
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T14:33:56Z/
url https://github.com/wolfSSL/wolfssl/pull/10088
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5504
risk_score 2.9
exploitability 0.5
weighted_severity 5.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bfap-h1d9-33dj
6
url VCID-cv4y-g4un-ckd4
vulnerability_id VCID-cv4y-g4un-ckd4
summary Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in the AEAD decryption path by injecting a TLS record shorter than the explicit IV plus authentication tag into traffic inspected by ssl_DecodePacket. The underflow wraps a 16-bit length to a large value that is passed to AEAD decryption routines, causing a large out-of-bounds read and crash. An unauthenticated attacker can trigger this remotely via malformed TLS Application Data records.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5778
reference_id
reference_type
scores
0
value 0.0006
scoring_system epss
scoring_elements 0.18817
published_at 2026-04-12T12:55:00Z
1
value 0.0006
scoring_system epss
scoring_elements 0.18865
published_at 2026-04-11T12:55:00Z
2
value 0.0006
scoring_system epss
scoring_elements 0.18765
published_at 2026-04-13T12:55:00Z
3
value 0.00061
scoring_system epss
scoring_elements 0.1882
published_at 2026-04-29T12:55:00Z
4
value 0.00061
scoring_system epss
scoring_elements 0.1888
published_at 2026-04-24T12:55:00Z
5
value 0.00061
scoring_system epss
scoring_elements 0.18861
published_at 2026-04-26T12:55:00Z
6
value 0.00061
scoring_system epss
scoring_elements 0.1897
published_at 2026-04-16T12:55:00Z
7
value 0.00061
scoring_system epss
scoring_elements 0.18982
published_at 2026-04-18T12:55:00Z
8
value 0.00061
scoring_system epss
scoring_elements 0.18988
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5778
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5778
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5778
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10125
reference_id 10125
reference_type
scores
0
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T13:53:21Z/
url https://github.com/wolfSSL/wolfssl/pull/10125
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5778
risk_score 0.9
exploitability 0.5
weighted_severity 1.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cv4y-g4un-ckd4
7
url VCID-f5kd-yqz2-nkcb
vulnerability_id VCID-f5kd-yqz2-nkcb
summary Two potential heap out-of-bounds write locations existed in DecodeObjectId() in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot before writing two OID arc values (out[0] and out[1]), enabling a 2-byte out-of-bounds write when outSz equals 1. Second, multiple callers pass sizeof(decOid) (64 bytes on 64-bit platforms) instead of the element count MAX_OID_SZ (32), causing the function to accept crafted OIDs with 33 or more arcs that write past the end of the allocated buffer.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5187
reference_id
reference_type
scores
0
value 0.00042
scoring_system epss
scoring_elements 0.12744
published_at 2026-04-12T12:55:00Z
1
value 0.00042
scoring_system epss
scoring_elements 0.12782
published_at 2026-04-11T12:55:00Z
2
value 0.00042
scoring_system epss
scoring_elements 0.12697
published_at 2026-04-13T12:55:00Z
3
value 0.00047
scoring_system epss
scoring_elements 0.14558
published_at 2026-04-29T12:55:00Z
4
value 0.00047
scoring_system epss
scoring_elements 0.14282
published_at 2026-04-16T12:55:00Z
5
value 0.00047
scoring_system epss
scoring_elements 0.14621
published_at 2026-04-24T12:55:00Z
6
value 0.00047
scoring_system epss
scoring_elements 0.14618
published_at 2026-04-26T12:55:00Z
7
value 0.00047
scoring_system epss
scoring_elements 0.14526
published_at 2026-04-18T12:55:00Z
8
value 0.00047
scoring_system epss
scoring_elements 0.1459
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5187
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5187
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5187
2
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
3
reference_url https://github.com/wolfSSL/wolfssl
reference_id wolfssl
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T14:03:11Z/
url https://github.com/wolfSSL/wolfssl
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5187
risk_score 1.1
exploitability 0.5
weighted_severity 2.1
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f5kd-yqz2-nkcb
8
url VCID-g5u9-khw6-4kgn
vulnerability_id VCID-g5u9-khw6-4kgn
summary An integer overflow existed in the wolfCrypt CMAC implementation, that could be exploited to forge CMAC tags. The function wc_CmacUpdate used the guard `if (cmac->totalSz != 0)` to skip XOR-chaining on the first block (where digest is all-zeros and the XOR is a no-op). However, totalSz is word32 and wraps to zero after 2^28 block flushes (4 GiB), causing the guard to erroneously discard the live CBC-MAC chain state. Any two messages sharing a common suffix beyond the 4 GiB mark then produce identical CMAC tags, enabling a zero-work prefix-substitution forgery. The fix removes the guard, making the XOR unconditional; the no-op property on the first block is preserved because digest is zero-initialized by wc_InitCmac_ex.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5477
reference_id
reference_type
scores
0
value 0.00035
scoring_system epss
scoring_elements 0.10327
published_at 2026-04-29T12:55:00Z
1
value 0.00042
scoring_system epss
scoring_elements 0.1292
published_at 2026-04-11T12:55:00Z
2
value 0.00042
scoring_system epss
scoring_elements 0.12885
published_at 2026-04-12T12:55:00Z
3
value 0.00042
scoring_system epss
scoring_elements 0.12839
published_at 2026-04-13T12:55:00Z
4
value 0.00055
scoring_system epss
scoring_elements 0.17377
published_at 2026-04-21T12:55:00Z
5
value 0.00055
scoring_system epss
scoring_elements 0.17335
published_at 2026-04-16T12:55:00Z
6
value 0.00055
scoring_system epss
scoring_elements 0.17343
published_at 2026-04-18T12:55:00Z
7
value 0.00055
scoring_system epss
scoring_elements 0.17283
published_at 2026-04-24T12:55:00Z
8
value 0.00055
scoring_system epss
scoring_elements 0.1726
published_at 2026-04-26T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5477
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5477
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5477
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10102
reference_id 10102
reference_type
scores
0
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T14:03:53Z/
url https://github.com/wolfSSL/wolfssl/pull/10102
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5477
risk_score 3.7
exploitability 0.5
weighted_severity 7.4
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g5u9-khw6-4kgn
9
url VCID-gtdh-mytb-t3fh
vulnerability_id VCID-gtdh-mytb-t3fh
summary wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-the-middle can therefore truncate the mac field from 16 bytes to 1 byte, reducing the tag check from 2⁻¹²⁸ to 2⁻⁸.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5500
reference_id
reference_type
scores
0
value 0.00094
scoring_system epss
scoring_elements 0.25942
published_at 2026-04-29T12:55:00Z
1
value 0.00133
scoring_system epss
scoring_elements 0.3287
published_at 2026-04-11T12:55:00Z
2
value 0.00133
scoring_system epss
scoring_elements 0.32831
published_at 2026-04-12T12:55:00Z
3
value 0.00133
scoring_system epss
scoring_elements 0.32806
published_at 2026-04-13T12:55:00Z
4
value 0.00142
scoring_system epss
scoring_elements 0.34363
published_at 2026-04-21T12:55:00Z
5
value 0.00142
scoring_system epss
scoring_elements 0.34418
published_at 2026-04-16T12:55:00Z
6
value 0.00142
scoring_system epss
scoring_elements 0.34405
published_at 2026-04-18T12:55:00Z
7
value 0.00142
scoring_system epss
scoring_elements 0.33992
published_at 2026-04-24T12:55:00Z
8
value 0.00142
scoring_system epss
scoring_elements 0.33972
published_at 2026-04-26T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5500
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5500
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5500
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10102
reference_id 10102
reference_type
scores
0
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T13:42:21Z/
url https://github.com/wolfSSL/wolfssl/pull/10102
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5500
risk_score 3.9
exploitability 0.5
weighted_severity 7.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gtdh-mytb-t3fh
10
url VCID-hdbf-118z-2yec
vulnerability_id VCID-hdbf-118z-2yec
summary wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the signature blob via `mp_read_unsigned_bin` with no check that they lie in `[1, q-1]`. A crafted forged signature could verify against any message for any identity, using only publicly-known constants.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5466
reference_id
reference_type
scores
0
value 0.00011
scoring_system epss
scoring_elements 0.01442
published_at 2026-04-13T12:55:00Z
1
value 0.00011
scoring_system epss
scoring_elements 0.01449
published_at 2026-04-11T12:55:00Z
2
value 8e-05
scoring_system epss
scoring_elements 0.00829
published_at 2026-04-26T12:55:00Z
3
value 8e-05
scoring_system epss
scoring_elements 0.00825
published_at 2026-04-29T12:55:00Z
4
value 8e-05
scoring_system epss
scoring_elements 0.00828
published_at 2026-04-24T12:55:00Z
5
value 8e-05
scoring_system epss
scoring_elements 0.00777
published_at 2026-04-16T12:55:00Z
6
value 8e-05
scoring_system epss
scoring_elements 0.00781
published_at 2026-04-18T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5466
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5466
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5466
2
reference_url https://github.com/wolfssl/wolfssl/pull/10102
reference_id 10102
reference_type
scores
0
value 7.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-10T13:43:28Z/
url https://github.com/wolfssl/wolfssl/pull/10102
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5466
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hdbf-118z-2yec
11
url VCID-jc3b-m4ud-n7fw
vulnerability_id VCID-jc3b-m4ud-n7fw
summary In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSL_EVP_CipherFinal (and related EVP cipher finalization functions) fails to verify the authentication tag before returning plaintext to the caller. When an application uses the EVP API to perform ChaCha20-Poly1305 decryption, the implementation computes or accepts the tag but does not compare it against the expected value.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5479
reference_id
reference_type
scores
0
value 7e-05
scoring_system epss
scoring_elements 0.00507
published_at 2026-04-12T12:55:00Z
1
value 7e-05
scoring_system epss
scoring_elements 0.0051
published_at 2026-04-11T12:55:00Z
2
value 7e-05
scoring_system epss
scoring_elements 0.00509
published_at 2026-04-13T12:55:00Z
3
value 8e-05
scoring_system epss
scoring_elements 0.00777
published_at 2026-04-29T12:55:00Z
4
value 8e-05
scoring_system epss
scoring_elements 0.00779
published_at 2026-04-24T12:55:00Z
5
value 8e-05
scoring_system epss
scoring_elements 0.0078
published_at 2026-04-26T12:55:00Z
6
value 8e-05
scoring_system epss
scoring_elements 0.00731
published_at 2026-04-16T12:55:00Z
7
value 8e-05
scoring_system epss
scoring_elements 0.00735
published_at 2026-04-18T12:55:00Z
8
value 8e-05
scoring_system epss
scoring_elements 0.00778
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5479
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5479
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5479
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10102
reference_id 10102
reference_type
scores
0
value 7.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-10T13:43:58Z/
url https://github.com/wolfSSL/wolfssl/pull/10102
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5479
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jc3b-m4ud-n7fw
12
url VCID-jvnf-vh29-ufdh
vulnerability_id VCID-jvnf-vh29-ufdh
summary A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. In the error handling path of TLSX_KeyShare_ProcessPqcHybridClient() in src/tls.c, the inner function TLSX_KeyShare_ProcessPqcClient_ex() frees a KyberKey object upon encountering an error. The caller then invokes TLSX_KeyShare_FreeAll(), which attempts to call ForceZero() on the already-freed KyberKey, resulting in writes of zero bytes over freed heap memory.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5460
reference_id
reference_type
scores
0
value 0.00042
scoring_system epss
scoring_elements 0.12885
published_at 2026-04-12T12:55:00Z
1
value 0.00042
scoring_system epss
scoring_elements 0.1292
published_at 2026-04-11T12:55:00Z
2
value 0.00042
scoring_system epss
scoring_elements 0.12839
published_at 2026-04-13T12:55:00Z
3
value 0.00055
scoring_system epss
scoring_elements 0.172
published_at 2026-04-29T12:55:00Z
4
value 0.00055
scoring_system epss
scoring_elements 0.17283
published_at 2026-04-24T12:55:00Z
5
value 0.00055
scoring_system epss
scoring_elements 0.1726
published_at 2026-04-26T12:55:00Z
6
value 0.00055
scoring_system epss
scoring_elements 0.17335
published_at 2026-04-16T12:55:00Z
7
value 0.00055
scoring_system epss
scoring_elements 0.17343
published_at 2026-04-18T12:55:00Z
8
value 0.00055
scoring_system epss
scoring_elements 0.17377
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5460
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5460
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5460
2
reference_url https://github.com/wolfssl/wolfssl/pull/10092
reference_id 10092
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T13:51:11Z/
url https://github.com/wolfssl/wolfssl/pull/10092
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5460
risk_score 2.9
exploitability 0.5
weighted_severity 5.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jvnf-vh29-ufdh
13
url VCID-n6uz-fe7m-uqhk
vulnerability_id VCID-n6uz-fe7m-uqhk
summary In TLSX_EchChangeSNI, the ctx->extensions branch set extensions unconditionally even when TLSX_Find returned NULL. This caused TLSX_UseSNI to attach the attacker-controlled publicName to the shared WOLFSSL_CTX when no inner SNI was configured. TLSX_EchRestoreSNI then failed to clean it up because its removal was gated on serverNameX != NULL. The inner ClientHello was sized before the pollution but written after it, causing TLSX_SNI_Write to memcpy 255 bytes past the allocation boundary.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5503
reference_id
reference_type
scores
0
value 0.00042
scoring_system epss
scoring_elements 0.12885
published_at 2026-04-12T12:55:00Z
1
value 0.00042
scoring_system epss
scoring_elements 0.1292
published_at 2026-04-11T12:55:00Z
2
value 0.00042
scoring_system epss
scoring_elements 0.12839
published_at 2026-04-13T12:55:00Z
3
value 0.00049
scoring_system epss
scoring_elements 0.14997
published_at 2026-04-29T12:55:00Z
4
value 0.00055
scoring_system epss
scoring_elements 0.17377
published_at 2026-04-21T12:55:00Z
5
value 0.00055
scoring_system epss
scoring_elements 0.17335
published_at 2026-04-16T12:55:00Z
6
value 0.00055
scoring_system epss
scoring_elements 0.17343
published_at 2026-04-18T12:55:00Z
7
value 0.00055
scoring_system epss
scoring_elements 0.17283
published_at 2026-04-24T12:55:00Z
8
value 0.00055
scoring_system epss
scoring_elements 0.1726
published_at 2026-04-26T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5503
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5503
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5503
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10102
reference_id 10102
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:58:43Z/
url https://github.com/wolfSSL/wolfssl/pull/10102
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5503
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n6uz-fe7m-uqhk
14
url VCID-nqhj-d7uw-43hd
vulnerability_id VCID-nqhj-d7uw-43hd
summary Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5264
reference_id
reference_type
scores
0
value 0.00183
scoring_system epss
scoring_elements 0.40079
published_at 2026-04-12T12:55:00Z
1
value 0.00183
scoring_system epss
scoring_elements 0.40116
published_at 2026-04-11T12:55:00Z
2
value 0.00183
scoring_system epss
scoring_elements 0.40059
published_at 2026-04-13T12:55:00Z
3
value 0.00241
scoring_system epss
scoring_elements 0.47323
published_at 2026-04-29T12:55:00Z
4
value 0.00241
scoring_system epss
scoring_elements 0.47367
published_at 2026-04-24T12:55:00Z
5
value 0.00241
scoring_system epss
scoring_elements 0.47376
published_at 2026-04-26T12:55:00Z
6
value 0.00241
scoring_system epss
scoring_elements 0.47435
published_at 2026-04-16T12:55:00Z
7
value 0.00241
scoring_system epss
scoring_elements 0.47429
published_at 2026-04-18T12:55:00Z
8
value 0.00241
scoring_system epss
scoring_elements 0.4738
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5264
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5264
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5264
2
reference_url https://github.com/wolfssl/wolfssl/pull/10076
reference_id 10076
reference_type
scores
0
value 8.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-04-10T13:55:34Z/
url https://github.com/wolfssl/wolfssl/pull/10076
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5264
risk_score 3.8
exploitability 0.5
weighted_severity 7.5
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nqhj-d7uw-43hd
15
url VCID-srmp-3tvp-9uhv
vulnerability_id VCID-srmp-3tvp-9uhv
summary A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wc_PKCS7_DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed OID into a fixed 32-byte stack buffer (oriOID[MAX_OID_SZ]) via XMEMCPY without first validating that the parsed OID length does not exceed MAX_OID_SZ. A crafted CMS EnvelopedData message with an ORI recipient containing an OID longer than 32 bytes triggers a stack buffer overflow. Exploitation requires the library to be built with --enable-pkcs7 (disabled by default) and the application to have registered an ORI decrypt callback via wc_PKCS7_SetOriDecryptCb().
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5295
reference_id
reference_type
scores
0
value 0.00016
scoring_system epss
scoring_elements 0.03765
published_at 2026-04-12T12:55:00Z
1
value 0.00016
scoring_system epss
scoring_elements 0.03785
published_at 2026-04-11T12:55:00Z
2
value 0.00016
scoring_system epss
scoring_elements 0.03738
published_at 2026-04-13T12:55:00Z
3
value 0.0002
scoring_system epss
scoring_elements 0.05408
published_at 2026-04-29T12:55:00Z
4
value 0.0002
scoring_system epss
scoring_elements 0.05173
published_at 2026-04-16T12:55:00Z
5
value 0.0002
scoring_system epss
scoring_elements 0.05367
published_at 2026-04-24T12:55:00Z
6
value 0.0002
scoring_system epss
scoring_elements 0.0541
published_at 2026-04-26T12:55:00Z
7
value 0.0002
scoring_system epss
scoring_elements 0.05178
published_at 2026-04-18T12:55:00Z
8
value 0.0002
scoring_system epss
scoring_elements 0.05332
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5295
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5295
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5295
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10116
reference_id 10116
reference_type
scores
0
value 5.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T14:32:50Z/
url https://github.com/wolfSSL/wolfssl/pull/10116
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5295
risk_score 2.6
exploitability 0.5
weighted_severity 5.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-srmp-3tvp-9uhv
16
url VCID-u55w-unmd-97cm
vulnerability_id VCID-u55w-unmd-97cm
summary wolfSSL: wolfSSL: Heap buffer overflow via AuthorityKeyIdentifier size confusion
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-5447.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-5447.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5447
reference_id
reference_type
scores
0
value 0.00033
scoring_system epss
scoring_elements 0.09455
published_at 2026-04-12T12:55:00Z
1
value 0.00033
scoring_system epss
scoring_elements 0.09482
published_at 2026-04-11T12:55:00Z
2
value 0.00033
scoring_system epss
scoring_elements 0.09438
published_at 2026-04-13T12:55:00Z
3
value 0.00043
scoring_system epss
scoring_elements 0.12948
published_at 2026-04-29T12:55:00Z
4
value 0.00043
scoring_system epss
scoring_elements 0.13083
published_at 2026-04-24T12:55:00Z
5
value 0.00043
scoring_system epss
scoring_elements 0.13052
published_at 2026-04-26T12:55:00Z
6
value 0.00043
scoring_system epss
scoring_elements 0.12989
published_at 2026-04-16T12:55:00Z
7
value 0.00043
scoring_system epss
scoring_elements 0.12992
published_at 2026-04-18T12:55:00Z
8
value 0.00043
scoring_system epss
scoring_elements 0.1309
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5447
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5447
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5447
3
reference_url https://github.com/wolfSSL/wolfssl/pull/10112
reference_id 10112
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T18:07:18Z/
url https://github.com/wolfSSL/wolfssl/pull/10112
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457074
reference_id 2457074
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457074
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5447
risk_score 2.9
exploitability 0.5
weighted_severity 5.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u55w-unmd-97cm
17
url VCID-udcq-enxt-wyf1
vulnerability_id VCID-udcq-enxt-wyf1
summary X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A buffer overflow may occur when parsing date fields from a crafted X.509 certificate via the compatibility layer API. This is only triggered when calling these two APIs directly from an application, and does not affect TLS or certificate verify operations in wolfSSL.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5448
reference_id
reference_type
scores
0
value 0.00015
scoring_system epss
scoring_elements 0.02806
published_at 2026-04-12T12:55:00Z
1
value 0.00015
scoring_system epss
scoring_elements 0.02825
published_at 2026-04-11T12:55:00Z
2
value 0.00015
scoring_system epss
scoring_elements 0.02801
published_at 2026-04-13T12:55:00Z
3
value 0.00017
scoring_system epss
scoring_elements 0.0447
published_at 2026-04-29T12:55:00Z
4
value 0.00017
scoring_system epss
scoring_elements 0.04408
published_at 2026-04-24T12:55:00Z
5
value 0.00017
scoring_system epss
scoring_elements 0.04429
published_at 2026-04-26T12:55:00Z
6
value 0.00017
scoring_system epss
scoring_elements 0.04253
published_at 2026-04-16T12:55:00Z
7
value 0.00017
scoring_system epss
scoring_elements 0.04263
published_at 2026-04-18T12:55:00Z
8
value 0.00017
scoring_system epss
scoring_elements 0.04389
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5448
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5448
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5448
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10071
reference_id 10071
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T13:51:49Z/
url https://github.com/wolfSSL/wolfssl/pull/10071
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5448
risk_score 1.1
exploitability 0.5
weighted_severity 2.1
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-udcq-enxt-wyf1
18
url VCID-ugd8-9xzt-xbdz
vulnerability_id VCID-ugd8-9xzt-xbdz
summary wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints `CA:FALSE` that is legitimately signed by a trusted root. An attacker who obtains any leaf certificate from a trusted CA (e.g. a free DV cert from Let's Encrypt) can forge a certificate for any subject name with any public key and arbitrary signature bytes, and the function returns `WOLFSSL_SUCCESS` / `X509_V_OK`. The native wolfSSL TLS handshake path (`ProcessPeerCerts`) is not susceptible and the issue is limited to applications using the OpenSSL compatibility API directly, which would include integrations of wolfSSL into nginx and haproxy.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5501
reference_id
reference_type
scores
0
value 0.0002
scoring_system epss
scoring_elements 0.05567
published_at 2026-04-29T12:55:00Z
1
value 0.00023
scoring_system epss
scoring_elements 0.06106
published_at 2026-04-11T12:55:00Z
2
value 0.00023
scoring_system epss
scoring_elements 0.06101
published_at 2026-04-12T12:55:00Z
3
value 0.00023
scoring_system epss
scoring_elements 0.06093
published_at 2026-04-13T12:55:00Z
4
value 0.00025
scoring_system epss
scoring_elements 0.07058
published_at 2026-04-24T12:55:00Z
5
value 0.00025
scoring_system epss
scoring_elements 0.06956
published_at 2026-04-16T12:55:00Z
6
value 0.00025
scoring_system epss
scoring_elements 0.0694
published_at 2026-04-18T12:55:00Z
7
value 0.00025
scoring_system epss
scoring_elements 0.07073
published_at 2026-04-21T12:55:00Z
8
value 0.00025
scoring_system epss
scoring_elements 0.07062
published_at 2026-04-26T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5501
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5501
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5501
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10102
reference_id 10102
reference_type
scores
0
value 8.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-04-10T13:42:50Z/
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-22T03:55:48Z/
url https://github.com/wolfSSL/wolfssl/pull/10102
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5501
risk_score 3.9
exploitability 0.5
weighted_severity 7.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ugd8-9xzt-xbdz
19
url VCID-vugd-2jfz-23b5
vulnerability_id VCID-vugd-2jfz-23b5
summary In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wc_AriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is zero-initialized at session setup and never incremented in non-FIPS builds. This vulnerability affects wolfSSL builds configured with --enable-aria and the proprietary MagicCrypto SDK (a non-default, opt-in configuration required for Korean regulatory deployments). AES-GCM is not affected because wc_AesGcmEncrypt_ex maintains an internal invocation counter independently of the call-site guard.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5446
reference_id
reference_type
scores
0
value 0.00042
scoring_system epss
scoring_elements 0.12744
published_at 2026-04-12T12:55:00Z
1
value 0.00042
scoring_system epss
scoring_elements 0.12782
published_at 2026-04-11T12:55:00Z
2
value 0.00042
scoring_system epss
scoring_elements 0.12697
published_at 2026-04-13T12:55:00Z
3
value 0.00047
scoring_system epss
scoring_elements 0.14298
published_at 2026-04-29T12:55:00Z
4
value 0.00047
scoring_system epss
scoring_elements 0.14379
published_at 2026-04-24T12:55:00Z
5
value 0.00047
scoring_system epss
scoring_elements 0.14353
published_at 2026-04-26T12:55:00Z
6
value 0.00047
scoring_system epss
scoring_elements 0.14282
published_at 2026-04-18T12:55:00Z
7
value 0.00047
scoring_system epss
scoring_elements 0.14351
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5446
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5446
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5446
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10111
reference_id 10111
reference_type
scores
0
value 6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T18:11:44Z/
url https://github.com/wolfSSL/wolfssl/pull/10111
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5446
risk_score 2.7
exploitability 0.5
weighted_severity 5.4
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vugd-2jfz-23b5
20
url VCID-x3uy-7crx-2kae
vulnerability_id VCID-x3uy-7crx-2kae
summary URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-5263
reference_id
reference_type
scores
0
value 0.0002
scoring_system epss
scoring_elements 0.05484
published_at 2026-04-12T12:55:00Z
1
value 0.0002
scoring_system epss
scoring_elements 0.05497
published_at 2026-04-11T12:55:00Z
2
value 0.0002
scoring_system epss
scoring_elements 0.05477
published_at 2026-04-13T12:55:00Z
3
value 0.00027
scoring_system epss
scoring_elements 0.07457
published_at 2026-04-29T12:55:00Z
4
value 0.00027
scoring_system epss
scoring_elements 0.075
published_at 2026-04-24T12:55:00Z
5
value 0.00027
scoring_system epss
scoring_elements 0.07489
published_at 2026-04-26T12:55:00Z
6
value 0.00027
scoring_system epss
scoring_elements 0.07422
published_at 2026-04-16T12:55:00Z
7
value 0.00027
scoring_system epss
scoring_elements 0.07411
published_at 2026-04-18T12:55:00Z
8
value 0.00027
scoring_system epss
scoring_elements 0.0754
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-5263
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5263
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5263
2
reference_url https://github.com/wolfSSL/wolfssl/pull/10048
reference_id 10048
reference_type
scores
0
value 7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T18:08:58Z/
url https://github.com/wolfSSL/wolfssl/pull/10048
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
reference_id 1133835
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133835
fixed_packages
0
url pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
purl pkg:apk/alpine/wolfssl@5.9.1-r0?arch=armv7&distroversion=edge&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community
aliases CVE-2026-5263
risk_score 3.1
exploitability 0.5
weighted_severity 6.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-x3uy-7crx-2kae
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.9.1-r0%3Farch=armv7&distroversion=edge&reponame=community