io.gravitee.apim.gateway:gravitee-apim-gateway-tests-sdk (>=4.12.0-milestone.1, <=4.12.20), io.gravitee.singularitee.engine.api:gravitee-singularitee-engine-api (>=1.3.0, <=1.6.0) +60 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=5.0.0, <=5.1.9)

io.vertx:vertx-grpc-server MAVEN version =5.0.0, =4.12.0-milestone.1, =1.3.0, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.3.0, =1.0.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.6.0 and more Source cves: CVE-2026-102477https://vuln...

CVE-2020-37281

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

CVE-2020-37281

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

CVE-2020-37281

Gravitee API Management versions through 4.12.22 are vulnerable to an authentication bypass caused by the use of a default JWT secret (CWE-1394). An unauthenticated remote attacker who knows an existing user ID can forge an HS256 token signed with the shipped default secret. By presenting this fo...

EUVD-2020-31280

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

CVE-2020-37281

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

PT-2026-113755

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

CVE-2020-37281: Use of Default Cryptographic Key

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

com.workoss.boot:storage-server (1.0.8), io.gravitee.am.identityprovider:gravitee-am-identityprovider-jdbc (>=3.10.0, <=3.14.7) +2 more potentially affected by CVE-2026-55860 via org.mariadb:r2dbc-mariadb (0.8.4-rc)

org.mariadb:r2dbc-mariadb MAVEN version 0.8.4-rc is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb:r2dbc-mariadb and may be impacted: - com.workoss.boot:storage-server 1.0.8 - io.gravitee.am.identityprovider:gravitee-am-identityprovider-jdbc...

com.workoss.boot:storage-server (1.0.8), io.gravitee.am.identityprovider:gravitee-am-identityprovider-jdbc (>=3.10.0, <=3.14.7) +2 more potentially affected by CVE-2026-55859 via org.mariadb:r2dbc-mariadb (0.8.4-rc)

org.mariadb:r2dbc-mariadb MAVEN version 0.8.4-rc is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb:r2dbc-mariadb and may be impacted: - com.workoss.boot:storage-server 1.0.8 - io.gravitee.am.identityprovider:gravitee-am-identityprovider-jdbc...

cn.net.vidyo:jsmth-data (3.3.120.release), com.github.vencent-lu:giants-cache-redis (>=1.0.4, <=1.0.5-beta-7) +4 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.4.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.net.vidyo:jsmth-data 3.3.120.release -...

io.gravitee.gateway.standalone:gravitee-gateway-standalone-container (>=0.2.0, <=0.7.0), io.gravitee.gateway.standalone:gravitee-gateway-standalone-distribution (>=0.2.0, <=0.7.0) +12 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.7.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.7.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

io.gravitee.gateway.standalone:gravitee-gateway-standalone-container (>=0.2.0, <=0.7.0), io.gravitee.gateway.standalone:gravitee-gateway-standalone-distribution (>=0.2.0, <=0.7.0) +12 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.7.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.7.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

CVE-2022-38723

Gravitee API Management before 3.15.13 allows path traversal through HTML injection...

EUVD-2022-6644

Malicious code in bioql PyPI...

EUVD-2023-0563

Malicious code in bioql PyPI...

com.identityx.auth:daon-http-digest-auth (>=4.4.0.10, <=5.0.0.2), com.identityx:identityxclientsdk (>=4.4.0.10, <=5.0.0.2) +21 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (5.14)

com.nimbusds:nimbus-jose-jwt MAVEN version 5.14 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.identityx.auth:daon-http-digest-auth =4.4.0.10, =4.4.0.10, =2.1.0, =2.3.0, =2.2.0, =2.2.0, =2.1.0,...

io.gravitee.gateway.handlers:gravitee-gateway-handlers-api (>=1.30.8, <=3.0.0-beta), io.gravitee.gateway.security:gravitee-gateway-security-jwt (>=1.30.8, <=3.0.0-beta) +12 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (8.12)

com.nimbusds:nimbus-jose-jwt MAVEN version 8.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - io.gravitee.gateway.handlers:gravitee-gateway-handlers-api =1.30.8, =1.30.8, =1.30.8, =1.30.8, =1.30.8,...