CVE-2026-93578

A flaw was found in Netty's Online Certificate Status Protocol OCSP Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage EKU in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority CA, can exploit this by...

CVE-2026-93493: Improper Check for Certificate Revocation

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol OCSP response that omits the optional nextUpdate field. This omission causes the OCSP validation to be silently skipped, leading to...

CVE-2026-93602: Improper Check for Certificate Revocation

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

CVE-2026-93578: Undefined Security Weakness

A flaw was found in Netty's Online Certificate Status Protocol OCSP Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage EKU in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority CA, can exploit this by...

PT-2026-99975

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

PT-2026-99982

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

tomcat: Apache Tomcat: Error condition not handled when configuring CRLs

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...

tomcat: Apache Tomcat: Error condition not handled when configuring CRLs

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...

CVE-2026-82761

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...

CVE-2026-78223

AshAuthentication (team-alembic, Elixir) suffers from an improper cryptographic signature verification in its token revocation flow. The function RevokeTokenChange.change/3 decodes the incoming token via Joken.peek_claims/1 without verifying its signature, then writes the jti, exp, and sub claims...

CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token...

CVE-2026-78223

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token...

CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token...

EEF-CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication

Summary Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the...

CVE-2026-82761

AshAuthentication (by team-alembic) is vulnerable to a TOCTOU race condition that allows concurrent redemptions of a single-use magic link token. The sign-in flow verifies the JWT via Jwt.verify/4 and revokes it only in an after_action or after_transaction hook, after the sign-in has already comm...

CLEANSTART-2026-KE88989 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Multiple security vulnerabilities affect the restic-fips package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

CLEANSTART-2026-JQ49818 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Multiple security vulnerabilities affect the minio-client package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

CVE-2026-86533: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with sessionidentifier :jti and requiretokenpresenceforauthentication? disabled stores its session value as :...

CVE-2026-78223: Improper Verification of Cryptographic Signature

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token...

CVE-2026-92800

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...