EUVD-2026-45038

A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash...

CVE-2026-49998 Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

CVE-2026-49998 Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

CVE-2023-5968

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:22+00:00| seen| Telegram/dpmbE18R2X3GFwkSOa6JWFFXWxZYAauVOJ1P4vKBnJxqD5U 2026-07-17 00:00:39+00:00| seen| Telegram/dpmbE18R2X3GFwkSOa6JWFFXWxZYAauVOJ1P4vKBnJxqD5U 2026-07-18 00:00:11+00:00| published-proof-of-concept|...

CVE-2025-65720

creationtimestamp| type| source ---|---|--- 2026-07-16 18:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrvoc5hlw2x...

CVE-2026-53536 Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret but did not check the token's audience, and combined with a missing null-check on the decoded fileId, this allow...

Malicious code in dde-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476 setup.py installs a telemetry.pth file into site-packages containing import telemetryinit, which causes Python's site.py to load the bootstrap module...

MAL-2026-10712 Malicious code in @hibachi-xyz/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d10da07b92571b7e043b1d5a8735143f7abac8e7759ae96b9f815052f01bf5 On require, index.js enumerates process.env and filters keys matching credential-shaped patterns KEY, SECRET, TOKEN, PASS, PRIV, SIGN, AWS, CIRCLE,...

USN-8557-1: Authlib vulnerabilities

Jay Neiva and Mauro Carrillo discovered that Authlib did not properly validate cryptographic keys embedded in JWT headers. An attacker could possibly use this issue to forge trusted tokens, resulting in authentication and authorization bypass. CVE-2026-27962 Jay Neiva and Mauro Carrillo discovere...

CVE-2026-59237

creationtimestamp| type| source ---|---|--- 2026-07-16 16:19:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrnbumdpi2m...

CVE-2026-63087 Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

MINI-6MF4-9XXC-JX45

Bulletin has no description...

MINI-7CWJ-22WG-RQFM

Bulletin has no description...

MINI-J4VG-JRX9-V6PJ

Bulletin has no description...

MINI-5FJG-JWF3-5823

Bulletin has no description...

CVE-2016-5085

creationtimestamp| type| source ---|---|--- 2026-07-16 13:00:05+00:00| seen| https://t.me/KaitNews/190 2026-07-17 00:00:51+00:00| published-proof-of-concept| https://t.me/KaitNews/190...

Malicious code in @hibachi-xyz/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2012c3b3a43f28209edf1c4b6fdbb0477c7c31f7574e37293cf7dd324f7f1e2f On require of the package's main entry, top-level code enumerates process.env and collects values whose keys match a credential-shaped regex KEY,...

MAL-2026-10713 Malicious code in @hibachi-xyz/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2012c3b3a43f28209edf1c4b6fdbb0477c7c31f7574e37293cf7dd324f7f1e2f On require of the package's main entry, top-level code enumerates process.env and collects values whose keys match a credential-shaped regex KEY,...

Malicious code in @hibachi-xyz/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54956c91d0cedbe9097a2a8f7fa864382bd3b5a91ba7ccbe4a0219081be711f9 index.js the package main executes at require-time and performs credential and host exfiltration. It iterates process.env and filters keys matching a...

CVE-2026-35149

CVE-2026-35149 involves HCL DFXServer and describes an authentication bypass caused by server response manipulation. The vulnerability allows an unauthenticated attacker to gain access by intercepting and altering authentication responses, effectively bypassing verification. Reported CVSS-3.1 met...