57844 matches found
PT-2026-76513
The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be validated. An unauthenticated remote...
CVE-2026-68770
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...
CVE-2026-68770
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...
CVE-2026-68770
The CVE affects the sentence-transformers library, where a logic flaw in the import_module_class helper (sentence_transformers/util/misc.py) adds an incorrect guard: os.path.exists(model_name_or_path) causes the trust_remote_code gate to pass whenever the provided path exists locally. This enable...
github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object
A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...
OPENSUSE-SU-2026:21515-1 Security update for python-joserfc
This update for python-joserfc fixes the following issues: Changes in python-joserfc: - CVE-2026-62995: acceptance of JWTs with trailing padding can lead to JWT malleability and allows for bypass of token revocation and anti-replay protection bsc1272991...
CVE-2026-18208 Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim
A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...
CVE-2026-18208 Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim
A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...
CVE-2026-18208
Affected product: Keycloak (keycloak-services OIDC token introspection endpoint). Issue: when a confidential client that expects signed JWT introspection responses inspects a token issued for a different audience, the endpoint still returns the full set of token claims inside a signed JWT field e...
SUSE CVE-2025-63811
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service DoS via crafted JSON Web Encryption JWE token with an exceptionally high compression ratio...
SUSE CVE-2026-9097
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken function in object/tokenoauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revok...
CVE-2026-18436: Missing Authorization
The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint POST /wp-json/mailpress/v1/campaign/ /restore-revision/ . The route in the vulnerable range was registered without a permissionCallback,...
Linux Distros Unpatched Vulnerability : CVE-2026-51293
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode function is invoked subsequent to sqlite3DbFree being called on the aBlob membe...
The vulnerability of the jsonCacheInsert() function in the json.c module of the SQLite database management system allows a hacker to execute arbitrary code.
The vulnerability of the jsonCacheInsert function in the json.c module of the SQLite database management system is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created JSON file...
PT-2026-66724
Name of the Vulnerable Software and Affected Versions keycloak-services affected versions not specified Description A flaw exists in the OIDC token introspection endpoint of the keycloak-services component. The issue occurs when a confidential client, configured to receive signed JWT JSON Web Tok...
Malicious code in ethers.json (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf52df7d6ae5e92551680d7529c4cdf686b19b742648e6ff80253deaa0c9919a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11298 Malicious code in ethers.json (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf52df7d6ae5e92551680d7529c4cdf686b19b742648e6ff80253deaa0c9919a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11293 Malicious code in eth.json (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83a74d7ffe1be2c23f1dc0a21529f6785e63c80990839f2d44aeaa4f514bef37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in eth.json (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83a74d7ffe1be2c23f1dc0a21529f6785e63c80990839f2d44aeaa4f514bef37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
