2574 matches found
GHSA-28JG-CGG7-J4WC Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation
A security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. An attacke...
Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation
A security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. An attacke...
Improper Validation of Specified Index, Position, or Offset in Input
Overview org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur. Affected versions of this package are vulnerable to Improper Validation of...
EUVD-2026-23846
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. A...
CVE-2026-33557
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. A...
CVE-2026-33557
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. A...
CVE-2026-33557
A security vulnerability exists in Apache Kafka due to the default configuration of the sasl.oauthbearer.jwt.validator.class property, which is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. This validator fails to verify the signature, issuer, or audience of JWT tokens....
CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. A...
CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. A...
CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. A...
MAL-2026-2946 Malicious code in moonbit-metrics-validator (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e6bb44c25db578131ec69b1c961c22f67cabb0b81aae5fe9d4620194bf8d83cc Campaign includes a chain of dependencies that finally exfiltrate sensitive environment variables to a hardcoded GitHub repository as exfiltration target, and ...
Malicious code in moonbit-metrics-validator (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e6bb44c25db578131ec69b1c961c22f67cabb0b81aae5fe9d4620194bf8d83cc Campaign includes a chain of dependencies that finally exfiltrate sensitive environment variables to a hardcoded GitHub repository as exfiltration target, and ...
Potential Security Misconfiguration when Using withIssuerLocation
When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder , it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator . This is easy to miss when using NimbusJwtDecoderwithIssuerLocation or...
GHSA-CQ8V-F236-94QC vulnerabilities
Vulnerabilities for packages: shadowsocks-rust, linkerd2, mountpoint-s3, parseable, linkerd-network-validator, vector, wizer, wasmcloud, ntpd-rs, qdrant, py3-xet-core, biome, uv, sdp-k8s-injector, yara-x, cargo-audit, efs-utils, starship, samply, kdash, lychee, zola, netavark, wadm, xh, cargo-c,...
GHSA-CQ8V-F236-94QC vulnerabilities
Vulnerabilities for packages: atuin, xh, rav1e, wasmtime, mise, ntpd-rs, typst, biome, berg, fnm, parseable, nushell, sdp-k8s-injector, py3-xet-core, sqlx, buck2, starship, komodo, pixi, virtiofsd, efs-utils, ruff, vector, mdbook, mountpoint-s3, garage, wasmcloud, zizmor, zola, wadm, yazi,...
CVE-2026-32605
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.numvalidators...
Malicious code in request-easy-validator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59057b0a6f845ac1e8bfa571c4e26295e469abdd5c6faa2e68007ef78816ec9b request-easy-validator impersonates the popular request package cloned README, bugs URL points at github.com/request/request, source is a fork of...
MAL-2026-2798 Malicious code in request-easy-validator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59057b0a6f845ac1e8bfa571c4e26295e469abdd5c6faa2e68007ef78816ec9b request-easy-validator impersonates the popular request package cloned README, bugs URL points at github.com/request/request, source is a fork of...
PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code
Summary The plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. The blocklist implemented in PluginSecurity.validateplugincode is incomplete and can be bypassed using several Python constructs that are not checked. An...
OpenClaw validateBindMounts Bypass
The vulnerability of the validateBindMounts function in the AI agent OpenClaw formerly ClawdBot or MoltBot is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a attacker to bypass existing security mechanisms...