PT-2026-61801

Name of the Vulnerable Software and Affected Versions praisonai-platform version 0.1.4 Description The software uses a hardcoded default secret dev-secret-change-me for signing JSON Web Tokens JWT. A security guard intended to prevent the application from starting in production with this default...

PT-2026-50738

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.11.0 ZITADEL versions 3.0.0 through 3.4.11 Description An authentication bypass exists in the external JWT Identity Provider IdP implementation. While the system validates the cryptographic signature and the...

CVE-2026-50202

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authentication.CloudFoundryBase prior to version 3.4.0, Steeltoe.Security.Authentication.JwtBearer prior to version 4.2.0, and...

CVE-2026-50202 Steeltoe's static JWKS cache shared across schemes and never invalidated

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authentication.CloudFoundryBase prior to version 3.4.0, Steeltoe.Security.Authentication.JwtBearer prior to version 4.2.0, and...

CVE-2026-50202

Summary: CVE-2026-50202 affects Steeltoe libraries: Steeltoe.Security.Authentication.CloudFoundryBase < 3.4.0, Steeltoe.Security.Authentication.JwtBearer < 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect

CVE-2026-50202 Steeltoe's static JWKS cache shared across schemes and never invalidated

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authentication.CloudFoundryBase prior to version 3.4.0, Steeltoe.Security.Authentication.JwtBearer prior to version 4.2.0, and...

CVE-2026-48990 joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength, which can lead to resource exhaustion...

DRUPAL-CORE-2026-008

The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL...

DRUPAL-CORE-2026-005

SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...

com.github.jknack:handlebars-jackson2 (0.4.1), com.github.jknack:handlebars-json (0.4.1) +2 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.4.1)

com.github.jknack:handlebars MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-jackson2 0.4.1 - com.github.jknack:handlebars-json 0.4.1 -...

com.github.jknack:handlebars-humanize (0.5.1), com.github.jknack:handlebars-jackson2 (0.5.1) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.5.1)

com.github.jknack:handlebars MAVEN version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.5.1 - com.github.jknack:handlebars-jackson2 0.5.1 -...

com.github.jknack:handlebars-humanize (0.5.3), com.github.jknack:handlebars-jackson2 (0.5.3) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.5.3)

com.github.jknack:handlebars MAVEN version 0.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.5.3 - com.github.jknack:handlebars-jackson2 0.5.3 -...

com.github.jknack:handlebars-humanize (0.5.4), com.github.jknack:handlebars-jackson2 (0.5.4) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.5.4)

com.github.jknack:handlebars MAVEN version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.5.4 - com.github.jknack:handlebars-jackson2 0.5.4 -...

com.github.jknack:handlebars-humanize (0.8.0), com.github.jknack:handlebars-jackson2 (0.8.0) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.8.0)

com.github.jknack:handlebars MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.8.0 - com.github.jknack:handlebars-jackson2 0.8.0 -...

com.github.jknack:handlebars-humanize (0.9.0), com.github.jknack:handlebars-jackson2 (0.9.0) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.9.0)

com.github.jknack:handlebars MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.9.0 - com.github.jknack:handlebars-jackson2 0.9.0 -...

com.github.jknack:handlebars-humanize (0.10.0), com.github.jknack:handlebars-jackson2 (0.10.0) +4 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.10.0)

com.github.jknack:handlebars MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.10.0 - com.github.jknack:handlebars-jackson2 0.10.0 -...

com.github.jknack:handlebars-guava-cache (0.11.0), com.github.jknack:handlebars-humanize (0.11.0) +4 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.11.0)

com.github.jknack:handlebars MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 0.11.0 - com.github.jknack:handlebars-humanize 0.11.0 -...

com.github.jknack:handlebars-guava-cache (0.12.0), com.github.jknack:handlebars-humanize (0.12.0) +5 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.12.0)

com.github.jknack:handlebars MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 0.12.0 - com.github.jknack:handlebars-humanize 0.12.0 -...

com.github.jknack:handlebars-guava-cache (1.1.1), com.github.jknack:handlebars-humanize (1.1.1) +6 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (1.1.1)

com.github.jknack:handlebars MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 1.1.1 - com.github.jknack:handlebars-humanize 1.1.1 -...

com.github.jknack:handlebars-guava-cache (2.3.0), com.github.jknack:handlebars-helpers (2.3.0) +11 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (2.3.0)

com.github.jknack:handlebars MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 2.3.0 - com.github.jknack:handlebars-helpers 2.3.0 -...