CVE-2026-22748 Potential Security Misconfiguration when Using withIssuerLocation

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from...

CVE-2026-22748 Potential Security Misconfiguration when Using withIssuerLocation

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from...

CVE-2026-40946

Oxia (metadata store and coordination system) prior to version 0.16.2 allows OIDC tokens to bypass standard audience validation. The root cause is that the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling aud claim validati...

JLSEC-2026-173

In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service daemon exit via a short timestamp. This is related to schemainit.c and checkTime...

Potential Security Misconfiguration when Using withIssuerLocation

When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder , it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator . This is easy to miss when using NimbusJwtDecoderwithIssuerLocation or...

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection via the parseDN handling and the LDAP store helpers in X509LDAPCertStoreSpi and LDAPStoreHelper. An attacker can influence LDAP search filters by supplying a crafted X.500 subject or issuer string that is parsed into an...

LDAP Injection

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to LDAP Injection via the parseDN handling and the LDAP store helpers in X509LDAPCertStoreSpi and LDAPStoreHelper. An attacker can influence LDAP search...

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection via the parseDN handling and the LDAP store helpers in X509LDAPCertStoreSpi and LDAPStoreHelper. An attacker can influence LDAP search filters by supplying a crafted X.500 subject or issuer string that is parsed into an...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: nodetaint, smokescreen, go, nova, flux-notification-controller, flux, hubble, dkron, github-mcp-server, metacontroller, apko, fluxcd-kustomize-mutating-webhook, victoriametrics, dgraph, supercronic, tailscale, local-path-provisioner, nfs-subdir-external-provisioner,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: rancher-fleet, cluster-autoscaler, nginx-prometheus-exporter, buildah, go-discover, cert-manager-cmctl, runc, opa-envoy, terraform-provider-pagerduty, kubernetes-csi-livenessprobe, terraform-provider-random, external-dns, secrets-store-csi-driver, docker-cli, keda,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: rancher-fleet, cluster-autoscaler, nginx-prometheus-exporter, buildah, go-discover, cert-manager-cmctl, runc, opa-envoy, terraform-provider-pagerduty, kubernetes-csi-livenessprobe, terraform-provider-random, external-dns, secrets-store-csi-driver, docker-cli, keda,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: malcontent, clickhouse-operator, kyverno-policy-reporter-plugins-kyverno, dbmate, commercial-chainloop-backend, cilium-certgen-fips, newrelic-k8s-metadata-injection-fips, victoriametrics-cluster, dkron, newrelic-k8s-metadata-injection, flux-helm-controller, atlas-fip...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: modelmesh-runtime-adapter, cloudnative-pg, docker-cli-buildx, crossplane-provider-aws-kms-fips, db-operator-fips, ucd, sonobuoy, commercial-chainloop-backend, bento, git-lfs, atlantis, kubernetes-csi-node-driver-registrar, kustomize-fips, snyk-cli,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: newrelic-k8s-metadata-injection-fips, crossplane-provider-aws-firehose-fips, cilium-certgen, dockerize-fips, dkron, vault-k8s, longhorn-engine, terraform-provider-kubernetes, addon-resizer, aws-efs-csi-driver, hcl2json-fips, k3s, git-lfs-fips, kor, buildtools,...

GHSA-CJW9-GHJ4-FWXF fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification

⚠️ IMPORTANT CLARIFICATIONS Affected Configurations This vulnerability ONLY affects applications that: - Use RegExp objects not strings in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options - Configure patterns susceptible to catastrophic backtracking - Example: allowedAud...

fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

Impact Using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt...

CVE-2026-35040 fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are statef...

CVE-2026-35040

CVE-2026-35040 affects the fast-jwt library prior to version 6.2.1. The issue involves stateful RegExp modifiers /g and /y used in allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce verify options, which can cause 50% of valid authentication attempts to fail in an alternating pattern...

SUSE CVE-2026-32144

Improper Certificate Validation vulnerability in Erlang OTP publickey pubkeyocsp module allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in publickey:pkixocspvalidate/5 does not verify that a CA-designated responder certificate...

CLEANSTART-2026-CV29689 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2025-62820, CVE-2026-25793, CVE-2026-30836 applied in versions: 0.10.2-r0, 0.9.10-r0, 0.9.9-r0, 0.9.9-r1

Multiple security vulnerabilities affect the step-issuer package. These issues are resolved in later releases. See references for individual vulnerability details...