PT-2025-47081

Name of the Vulnerable Software and Affected Versions shsuishang ShopSuite ModulithShop versions prior to 45a99398cec3b7ad7ff9383694f0b53339f2d35a Description A path traversal issue exists in shsuishang ShopSuite ModulithShop. The JwtAuthenticationFilter function within the...

kgateway is missing xDS authorization

Summary The xDS interface in Kgateway versions 2.0.0 through 2.0.4 lacks authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster...

EUVD-2025-34925

The Restaurant Brands International RBI assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API to return a signed AWS upload URL, for any store's path...

CVE-2025-10294

The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownidsharedsecret value is empty prior to authenticating a user via JWT. This makes it possible for...

EUVD-2018-0571

Malware in sbrugna...

EUVD-2021-26510

Malware in sbrugna...

EUVD-2024-48880

Malicious code in bioql PyPI...

EUVD-2023-23643

Malicious code in bioql PyPI...

EUVD-2021-28253

Malicious code in bioql PyPI...

EUVD-2021-8686

Malicious code in bioql PyPI...

EUVD-2024-49397

Malicious code in bioql PyPI...

EUVD-2023-2260

Malicious code in bioql PyPI...

EUVD-2024-47148

Malicious code in bioql PyPI...

EUVD-2023-35198

Malicious code in bioql PyPI...

EUVD-2024-22527

Malicious code in bioql PyPI...

CVE-2025-52101

linjiashop =0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and retrieve the encrypted "password" and "salt". The password can then be obtained through brute-force cracking...

CVE-2025-52101

linjiashop =0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and retrieve the encrypted "password" and "salt". The password can then be obtained through brute-force cracking...

CVE-2025-34063 OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary user...

CVE-2025-52101

linjiashop =0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and retrieve the encrypted "password" and "salt". The password can then be obtained through brute-force cracking...

CVE-2025-52101

linjiashop =0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and retrieve the encrypted "password" and "salt". The password can then be obtained through brute-force cracking...