CVE-2026-75509 joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

CVE-2026-75509

joserfc is a Python library implementing JOSE standards. Prior to version 1.7.3 , the JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, meaning an array-valued iss claim that merely contains the expected issuer will pass an intended equality check. This enables issu...

CVE-2026-66908

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

Astra Linux – Vulnerability in curl

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take ‘issuercert’ into account, and it compared the involved paths case insensitively, which could...

Astra Linux – Vulnerability in OpenLDAP

In OpenLDAP versions 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function due to a malicious packet. This leads to a denial of service daemon exits caused by a short timestamp. This issue is related to the schemainit.c file and the...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: frankenphp-8.4, frankenphp-8.5, frankenphp-8.2, caddy, step-issuer-fips, step-ca-fips, caddy-fips, frankenphp-8.3...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns-fips, gitlab-operator, cert-manager-csi-driver, opentelemetry-operator-fips, aws-privateca-issuer-fips, step-issuer-fips, cert-manager-istio-csr-fips, opentelemetry-operator, cert-manager-openshift-routes-fips, cert-manager-istio-csr,...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer-fips, cert-manager-istio-csr, cert-manager-webhook-pdns-fips, cert-manager-cmctl-fips, cert-manager-webhook-pdns, cert-exporter, step-issuer-fips, aws-privateca-issuer, cert-manager-cmctl, step-issuer, cert-exporter-fips...

GO-2026-4458 vulnerabilities

Vulnerabilities for packages: step, caddy, step-ca, step-issuer...

GO-2025-4068 vulnerabilities

Vulnerabilities for packages: step, caddy, step-ca, step-issuer...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: buf, sftpgo, kyverno-policy-reporter-ui, rclone, step-issuer, gitness, step, cloudflared, karma, tkn, gogatekeeper, caddy, step-ca...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, aws-privateca-issuer, step-issuer, cert-manager-istio-csr, cert-exporter, cert-manager-webhook-pdns...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: mariadb-operator, cert-manager-cmctl, percona-server-mongodb-operator, aws-privateca-issuer, step-issuer, cert-manager-istio-csr, opentelemetry-operator, cert-manager-webhook-pdns, cert-manager-csi-driver...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: harbor-registry, k3s, thanos-operator, wal-g, prometheus-operator, kubernetes-dashboard-api, kapp, kubernetes-csi-driver-nfs, polaris, dex, docker-machine-driver-harvester, bom, helm-set-status, aws-eks-pod-identity-agent, grafana-rollout-operator, emissary,...

CVE-2026-18353

A flaw was found in PIA. An unauthenticated attacker can exploit a Server-Side Request Forgery SSRF vulnerability by crafting a malicious OpenID Connect OIDC issuer URL. This bypasses an internal allowlist due to inconsistent URL parsing between Python's urlparse and the requests/urllib3 librarie...

python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens

A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...

python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens

A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...

python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens

A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...

CVE-2026-69092

CVE-2026-69092 affects Admidio versions before 5.0.11. The issue is a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or Ligh...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the check method of ProvOcspRevocationChecker, which verifies a stapled OCSP response's signature and then treats the certificate as unrevoked when no SingleResponse entry matches its CertID, without...