{"items":[{"id":"CVE-2026-40097","published":"2026-04-10T16:34:53.330Z","updated":"2026-04-10T18:30:15.176Z","title":"Step CA affected by an index out of bounds panic in TPM attestation EKU validation","severity":"LOW","score":3.7,"vendor":"smallstep","product":"certificates","kev":false,"epss":0.00188,"kevAdded":null,"exploit":false},{"id":"CVE-2026-30836","published":"2026-03-19T20:37:05.757Z","updated":"2026-03-25T14:16:09.012Z","title":"Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)","severity":"CRITICAL","score":10,"vendor":"smallstep","product":"certificates","kev":false,"epss":0.00308,"kevAdded":null,"exploit":false},{"id":"CVE-2025-44005","published":"2025-12-17T15:16:16.495Z","updated":"2025-12-17T18:00:09.151Z","title":"An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol…","severity":"CRITICAL","score":10,"vendor":"smallstep","product":"Step-CA","kev":false,"epss":0.09091,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66406","published":"2025-12-03T19:13:48.240Z","updated":"2025-12-03T21:40:59.681Z","title":"Improper Authorization Check for SSH Certificate Revocation","severity":"MEDIUM","score":5,"vendor":"smallstep","product":"certificates","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false}]}