CVE-2026-63408

In Grav API Plugin before 1.0.0-rc.16, JwtAuthenticator::extractBearerToken() accepts a JWT via the ?token= URL query parameter on all /api/v1 routes, exposing valid tokens in Apache/proxy/CDN logs, browser history, and Referer headers. An attacker with access to those records can reuse the token...

CVE-2021-22190

A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token...

EUVD-2021-9336

Malicious code in bioql PyPI...

Path traversal

A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token...