Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

729 matches found

UbuntuCve
UbuntuCve•added 2026/05/28 4:16 p.m.•11 views

CVE-2026-48526

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the...

7.4CVSS6.3AI score0.00427EPSS
SaveExploits1References3
Debian CVE
Debian CVE•added 2026/05/28 3:09 p.m.•38 views

CVE-2026-48526

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the...

7.4CVSS5.8AI score0.00427EPSS
SaveExploits1
attackerkb
attackerkb•added 2026/05/28 3:09 p.m.•26 views

CVE-2026-48526

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the...

7.4CVSS5.8AI score0.00427EPSS
SaveExploits1References2Affected Software1
SUSE CVE
SUSE CVE•added 2026/05/28 3:58 a.m.•30 views

SUSE CVE-2026-42789

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

7.4CVSS7.4AI score0.00351EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies•added 2026/05/28 12:00 a.m.•25 views

PT-2026-44398

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.13.0 Description PyJWT is a JSON Web Token implementation in Python. When the verifier decodes JSON Web Tokens while supporting both asymmetric and HMAC algorithms, the library fails to validate the use of JSON Web Ke...

7.4CVSS5.2AI score0.00427EPSS
SaveExploits1References407
Positive Technologies
Positive Technologies•added 2026/05/28 12:00 a.m.•32 views

PT-2026-44579

Name of the Vulnerable Software and Affected Versions glib-networking affected versions not specified Description A flaw exists where a remote attacker can cause a denial of service for an affected process or worker. This occurs when an application uses glib-networking with the GnuTLS backend...

4.3CVSS5.2AI score0.00181EPSS
SaveExploits0References29
OSV
OSV•added 2026/05/27 2:16 p.m.•64 views

DEBIAN-CVE-2026-42789

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

4.8CVSS7.3AI score0.00351EPSS
SaveExploits0References1
OSV
OSV•added 2026/05/27 2:16 p.m.•9 views

AZL-89172 CVE-2026-42789 affecting package erlang for versions less than 26.2.5.21-1

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

8CVSS7.4AI score0.00351EPSS
SaveExploits0References1
NVD
NVD•added 2026/05/27 2:16 p.m.•26 views

CVE-2026-42789

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

8CVSS0.00351EPSS
SaveExploits0References11
UbuntuCve
UbuntuCve•added 2026/05/27 2:16 p.m.•21 views

CVE-2026-42789

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

8CVSS7.3AI score0.00351EPSS
SaveExploits0References9
Vulnrichment
Vulnrichment•added 2026/05/27 12:23 p.m.•18 views

CVE-2026-42789 Non-CA certificate accepted as intermediate issuer in public_key path validation

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

7CVSS7.4AI score0.00351EPSS
SaveExploits0References6
CVE
CVE•added 2026/05/27 12:23 p.m.•177 views

CVE-2026-42789

The CVE-2026-42789 entry documents a vulnerability in Erlang OTP public_key (pubkey_cert module): a certificate with basicConstraints cA:false and no keyUsage can be misused as an intermediate issuer during pkix_path_validation, enabling chain forgery. Two flaws in pubkey_cert:validate_extensions...

8CVSS7.4AI score0.00351EPSS
SaveExploits0References11Affected Software1
EUVD
EUVD•added 2026/05/27 12:23 p.m.•24 views

EUVD-2026-32272

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

7CVSS5.9AI score0.00351EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies•added 2026/05/27 12:00 a.m.•27 views

PT-2026-43712

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 17.0 through 26.2.5.20 Erlang OTP versions 27.x prior to 27.3.4.12 Erlang OTP versions 28.x prior to 28.5.0.1 Erlang OTP versions 29.x prior to 29.0.1 public key versions 0.22 through 1.15.1.6 public key versions 1.17.x pri...

8CVSS5.9AI score0.00351EPSS
SaveExploits0References91
NVD
NVD•added 2026/05/26 6:16 p.m.•23 views

CVE-2026-41164

nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint /auth/v1/introspectaccesstoken accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims...

4.4CVSS0.00102EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies•added 2026/05/21 12:00 a.m.•25 views

PT-2026-44138

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 6.4 Description The OidcTokenHandler component, used for OpenID Connect access-token handling, fails to properly validate mandatory claims in bearer JWTs. While it registers checkers for audience aud, issuer iss, and...

9.1CVSS6.1AI score0.00258EPSS
SaveExploits0References20
Snyk
Snyk•added 2026/05/20 3:35 p.m.•29 views

Improper Verification of Cryptographic Signature

Overview symfony/security-http is a provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. Affected versions of this package are vulnerable to...

9.3CVSS5.8AI score0.00258EPSS
SaveExploits0References2
OSV
OSV•added 2026/05/18 12:56 p.m.•26 views

CLEANSTART-2026-CD71342 Security fixes for CVE-2025-47911, CVE-2025-58190, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501 applied in versions: 1.7.0-r0, 1.7.0-r1

Multiple security vulnerabilities affect the aws-privateca-issuer-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

9.8CVSS7.2AI score0.00868EPSS
SaveExploits1References47
OSV
OSV•added 2026/05/18 12:56 p.m.•50 views

CLEANSTART-2026-GY76045 Security fixes for CVE-2025-47911, CVE-2025-58190, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501 applied in versions: 1.7.0-r0

Multiple security vulnerabilities affect the aws-privateca-issuer package. These issues are resolved in later releases. See references for individual vulnerability details...

9.8CVSS7.2AI score0.00868EPSS
SaveExploits1References47
Veracode
Veracode•added 2026/05/15 10:15 a.m.•30 views

Authentication Bypass

Unity Catalog is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of the iss claim in JWT tokens, where the token exchange endpoint dynamically fetches JWKS data based on attacker-controlled issuer values without verifying trusted identity providers, allowing...

9.1CVSS5.8AI score0.0023EPSS
SaveExploits0References2Affected Software1
Rows per page
Query Builder