CVE-2026-107857

The Mindwtr mobile application (versions prior to 1.1.5 ) suffers from a vulnerability where the Cloud sync bearer token and WebDAV password are stored in plaintext within unencrypted AsyncStorage . Specifically, these credentials are stored under the keys @mindwtr_cloud_token and @mindwtr_webdav...

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named token and the AuthRequired middleware accepts that cookie as an authentication source. Because management endpoints are protected by AuthRequired and do not enforce a universal CSRF token or Origin/Referer check, a remote attack...

GHSA-33RR-WQ23-G6GG Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named token and the AuthRequired middleware accepts that cookie as an authentication source. Because management endpoints are protected by AuthRequired and do not enforce a universal CSRF token or Origin/Referer check, a remote attack...

GHSA-32GC-WF3M-78W9 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Summary 0xJacky/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credentials. The source code shows that cluster node list and detail endpoints are reachable by ordinary authenticated users and return node objects containing the token field. That sa...

CVE-2026-78384

A flaw was found in Apache CXF. A remote attacker can trigger a Denial of Service DoS by submitting specially crafted compressed data during token processing. Because the system decompresses incoming data without enforcing a maximum output size limit, a small payload can consume excessive heap...

CVE-2026-97468

A flaw was found in Apache CXF. The Security Token Service STS and token validation components cache validated security tokens using a weak, non-cryptographic hash function and treat cache matches as proof of validity. A remote attacker can craft a security token that generates a hash collision...

CVE-2026-107811

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...

CVE-2026-104084

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token...

CVE-2026-107811

The Nginx UI web interface for the Nginx web server is vulnerable in versions 2.0.0 through 2.5.0 . Authenticated users can access the /api/nodes and /api/nodes/:id endpoints, which serialize and leak the node token field. An attacker can use this token as the X-Node-Secret header to bypass authe...

CVE-2026-107811 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...

EUVD-2026-95890

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token...

CVE-2026-104084 SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token...

CVE-2026-104084 SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token...

CVE-2026-104084

SmarterMail versions prior to Build 9777 are susceptible to a privilege escalation vulnerability due to stale JWT role claims. The root cause is that JWT access and refresh tokens embed a role claim at issuance which is not revalidated against the account's current role during redemption via the ...

SUSE-SU-2026:24126-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...

SUSE-SU-2026:24134-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...

CVE-2026-97468

Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...

BIT-GHOST-2026-103273 Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level...

CVE-2026-97468

Apache CXF 's STSTokenValidator and Security Token Service (STS) are vulnerable to an authentication bypass because they cache validated security tokens using a weak, non-cryptographic 32-bit hash (Java Arrays.hashCode/hashCode() ). A remote attacker can craft a security token, such as a Username...

CVE-2026-97468

Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...