CVE-2026-93578

CVE-2026-93578 affects the Netty library, specifically the netty-handler-ssl-ocsp module. The vulnerability stems from a missing Extended Key Usage (EKU) check in the OCSP client, which allows an attacker to perform a certificate revocation bypass . An OCSP response signed with a certificate lack...

CVE-2026-93578

A flaw was found in Netty's Online Certificate Status Protocol OCSP Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage EKU in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority CA, can exploit this by...

CVE-2026-82761

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...

CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token...

CVE-2026-78223

AshAuthentication (team-alembic, Elixir) suffers from an improper cryptographic signature verification in its token revocation flow. The function RevokeTokenChange.change/3 decodes the incoming token via Joken.peek_claims/1 without verifying its signature, then writes the jti, exp, and sub claims...

CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token...

CVE-2026-82761

AshAuthentication (by team-alembic) is vulnerable to a TOCTOU race condition that allows concurrent redemptions of a single-use magic link token. The sign-in flow verifies the JWT via Jwt.verify/4 and revokes it only in an after_action or after_transaction hook, after the sign-in has already comm...

CLEANSTART-2026-KE88989 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Multiple security vulnerabilities affect the restic-fips package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

cve-2026-29145

CVE-2026-29145 — OCSP checks sometimes soft-fail even when soft-fail is disabled Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2026-02-26 Affected Vendor: Apache Affected Product: Tomcat Severity: 9.1 CRITICAL CWE: CWE-287 Improper Authentication Status: Under Review /...

CLEANSTART-2026-JQ49818 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Multiple security vulnerabilities affect the minio-client package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

CVE-2026-92800

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

CVE-2026-92800

Docs (by suitenumerique) versions before 5.4.1 fail to properly revoke websocket collaboration connections when access is revoked at parent documents. This allows an attacker whose access has been revoked to retain real-time read and write access to sub-documents through stale websocket sessions ...

CVE-2026-92800 Docs before 5.4.1 Stale Collaboration Session After Access Revocation

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

CVE-2026-92800 Docs before 5.4.1 Stale Collaboration Session After Access Revocation

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

EUVD-2026-81060

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

CVE-2026-92783

Yeti (through version 2.11.0 ) fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with only read access to delete access control (RBAC) relationships. An attacker can revoke the owner's grant and permanently lock legitimate owners out of objects . The vu...

CVE-2026-85387

Concrete CMS before 9.5.4 contains an insufficient session expiration flaw in its OAuth REST API authorization validator. The validator confirmed only that a bearer token existed, had not expired, and had not been explicitly revoked, but did not re-check the account state of the token's owner. Co...

GO-2026-6473 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel

ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...

CVE-2026-29145-Tester

CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...

CVE-2026-8863

CVE-2026-8863 Collection of the signed UEFI Secure Boot shim binaries affected by CVE-2026-8863, with the embedded shim version, Authenticode signer and revocation hashes of each image. Releases that ship the byte-identical signed shim are collapsed onto a single row — one Authenticode hash is on...