Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Legion of the Bouncy Castle BC-FJA 1.0.13, 2.0.13, 2.1.13 Clear all filters
TI-2026-67475 CVE-2026-71888 · GHSA-j453-27jp-4cph

CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent

Priority MEDIUM 42

In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00112 Published 2026-10-03 Partial fix · 1.86, 2.73.13 +5 CWE-354
TI-2026-67476 CVE-2026-71889 · GHSA-hqqj-v58h-gr7x

PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

Priority MEDIUM 43

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints t…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00167 Published 2026-10-03 Partial fix · 1.86, 2.73.13 +3 CWE-295