Cache Poisoning

get-jwks is vulnerable to cache poisoning. The vulnerability is due to a design flaw where the iss issuer claim may be validated only after keys are retrieved from a shared JWKS cache, which allows an attacker to push a chosen public key into the cache with one crafted JWT and then reuse that...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the getIssuerCertificate function. An attacker can gain unauthorized access to Secrets in other namespaces by bypassing RBAC restrictions. This is only exploitable if the attacker has permission to create...

GHSA-X6FH-7QMF-69XH vulnerabilities

Vulnerabilities for packages: step-issuer, caddy, step, step-ca...

CVE-2025-62820 vulnerabilities

Vulnerabilities for packages: step-issuer, caddy, step, step-ca...

CVE-2025-62820 vulnerabilities

Vulnerabilities for packages: step-fips, caddy, caddy-fips, step-ca, step-issuer, step-issuer-fips, step, step-ca-fips...

GHSA-X6FH-7QMF-69XH vulnerabilities

Vulnerabilities for packages: step-fips, caddy, caddy-fips, step-ca, step-issuer, step-issuer-fips, step, step-ca-fips...

Unverified Ownership

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Unverified Ownership via the JWT authentication process. An attacker can gain unauthorized access to protected resources by presenting a valid token intended for a different audience when...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the audit logging process. An attacker can obtain sensitive information by accessing improperly redacted HTTP request bodies recorded in audit logs. This may expose short-lived...

CVE-2025-62513 OpenBao leaks HTTPRawBody in Audit Logs

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted HMAC'd. This impacts those using the ACME functionality of PKI, resulting in...

ROS-20251016-04

Vulnerability of X509VERIFYPARAMadd0policy function of OpenSSL library is related to errors in the procedure of of certificate authentication. Exploitation of the vulnerability could allow an attacker acting remotely to perform a "man-in-the-middle" type of attack. remotely to perform a...

JLSEC-2025-28 libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if...

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths case insensitively,which could lead ...

EUVD-2018-0791

Malware in sbrugna...

EUVD-2021-10053

Malware in sbrugna...

EUVD-2016-2379

Malware in sbrugna...

EUVD-2017-9444

Malware in sbrugna...

EUVD-2025-31349

Malicious code in bioql PyPI...

EUVD-2024-3440

Malicious code in bioql PyPI...

EUVD-2022-4881

Malicious code in bioql PyPI...

CVE-2025-59936

get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...

Improper Encoding or Escaping of Output

Overview get-jwks is a Fetch utils for JWKS keys Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the JWKS cache process. An attacker can bypass issuer validation by poisoning the cache with keys from an unexpected issuer and subsequently leveraging...