CVE-2026-41213 @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the...

EUVD-2026-25272

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the...

CVE-2026-41213 @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the...

CVE-2026-41213

The CVE concerns @node-oauth/oauth2-server, a Node.js OAuth2 server module. The token exchange path accepts RFC7636-invalid code_verifier values for S256 PKCE flows (including one-character verifiers). The underlying cause is that ABNF enforcement for code_verifier is not performed during token e...

CVE-2026-41213 @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the...

CVE-2026-31533

creationtimestamp| type| source ---|---|--- 2026-04-23 18:12:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116455370337412135 2026-04-24 07:27:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116458496402084891 2026-05-05 20:00:00+00:00| seen|...

CVE-2026-41196

creationtimestamp| type| source ---|---|--- 2026-04-23 05:18:40+00:00| seen| Telegram/x9tyUe3u3o8RRyRxn4MyOTn6X2M4g6ykuZunUy8vPfx8ng 2026-04-23 06:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116452493196424144 2026-04-23 06:00:35+00:00| seen|...

@node-oauth/oauth2-server 安全漏洞

@node-oauth/oauth2-server is an open-source Node.js OAuth2 server implementation that adheres to RFC standards. @node-oauth/oauth2-server has a security vulnerability; this vulnerability stems from the token exchange path accepting an invalid codeverifier value according to RFC7636, which may lea...

CVE-2026-26354

creationtimestamp| type| source ---|---|--- 2026-04-22 19:00:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116449896805134925 2026-04-22 20:02:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk4c2yazua2z 2026-04-22 21:20:52+00:00| seen|...

CVE-2026-31456

creationtimestamp| type| source ---|---|--- 2026-04-22 15:51:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116449153245629356 2026-05-31 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities20260601...

CVE-2026-31478

creationtimestamp| type| source ---|---|--- 2026-04-22 15:11:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116448996317066096 2026-05-05 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260506 2026-07-02 05:48:08+00:00|...

openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables

A flaw was found in the OpenSSH GSSAPI Generic Security Service Application Program Interface delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the...

CVE-2026-31433

creationtimestamp| type| source ---|---|--- 2026-04-22 14:30:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116448835101441112 2026-05-05 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260506 2026-08-03 05:29:32+00:00|...

CVE-2026-6859

creationtimestamp| type| source ---|---|--- 2026-04-22 14:03:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116448728591423410 2026-04-22 14:14:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3omhcshf2e 2026-04-22 15:17:58+00:00| published-proof-of-concept|...

CLSA-2026-1776864708 Fix CVE(s): CVE-2019-13115, CVE-2019-3855, CVE-2019-3856, CVE-2019-3863

SECURITY UPDATE: integer overflow in transport read allowing out-of-bounds write via crafted SSH packet - debian/patches/CVE-2019-3855.patch: add packetlength bounds check against LIBSSH2PACKETMAXPAYLOAD in transport read - CVE-2019-3855 SECURITY UPDATE: integer overflow in keyboard-interactive...

CVE-2026-41586

creationtimestamp| type| source ---|---|--- 2026-04-22 12:54:53+00:00| published-proof-of-concept| https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7 2026-04-22 12:54:53+00:00| published-proof-of-concept|...

CVE-2026-3323

creationtimestamp| type| source ---|---|--- 2026-04-22 09:45:08+00:00| seen| https://infosec.exchange/users/certvde/statuses/116447714191251575 2026-04-28 16:59:45+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mkl2oanfoq2o 2026-05-04 08:39:55+00:00| seen|...

PT-2026-36652

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The built-in SSH server uses default configurations that advertise weak or broken key exchange, MAC, and host key algorithms. Specifically, the server supports the ecdh-sha2-nistp256,...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the use of the cmpxchg serialization to access so-tx.buf. This vulnerability may lead to the...

openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables

A flaw was found in the OpenSSH GSSAPI Generic Security Service Application Program Interface delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the...