CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-76216

Vikunja through 2.4.0 is affected by a principal-type confusion vulnerability. Three permission checks lack type guards, causing LinkSharing principals with id N to be incorrectly treated as user principals where users.id == N. An attacker holding a valid link-share JWT can exploit id collisions ...

EUVD-2026-62457

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

PT-2026-78398

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

RDK-B WebUI contains multiple vulnerabilities

Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication,...

PT-2026-78446

Name of the Vulnerable Software and Affected Versions Cudy WR3000 2.0 versions prior to 2.5.24 Description The Mosquitto MQTT broker authentication plugin contains a hard-coded JWT HMAC signing secret. This allows unauthenticated attackers to extract the secret from the firmware image and forge...

CVE-2026-65984

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js...

CVE-2026-65984

FUXA (web-based SCADA/HMI/Dashboard software) versions 1.3.2 and earlier contain a JWT lifecycle flaw in two endpoints: POST /api/refresh in server/api/auth/index.js falls back to decoded.groups when the user record is missing or groups is zero, and POST /api/heartbeat in server/api/index.js re-s...

CVE-2026-65984 FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js...

CVE-2026-65984 FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js...

CVE-2026-67443

In FUXA ≤1.3.2, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity, so an unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and access the RED.httpAdmin editor. Wi...

CVE-2026-67443 FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

CVE-2026-67443 FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

CVE-2026-55165

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2025-9210

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165

In Lemur 1.9.0 and earlier, lemur/auth/service.py:130-137 reads the alg field from an unverified JWT header and passes it to pyjwt.decode(..., algorithms=[header_data["alg"]]), letting an attacker choose the verification algorithm. PyJWT 2.x blocks alg=none, so direct ATO requires a separate LEMU...