user-security-stories

User Security Stories This repository contains a collection of user security stories and acceptance criteria. User Security Stories Security Acceptance Criteria Please fork and contribute additional security stories and acceptance criteria that you think will benefit the community. History The...

superpowers-evals

Superpowers Evals Behavioral eval lab for superpowers. Quorum drives real coding-agent CLIs Claude, Codex, Antigravity, Gemini, Kimi, OpenCode, Pi, and Copilot through a Gauntlet QA agent and grades them against scenario acceptance criteria plus deterministic post-checks. Code, CLI, paths, and...

GHSA-RVQ5-WWQV-78PQ MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

CVE-2026-97791

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accept...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a...

CVE-2026-103267

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

CVE-2026-103267: Reliance on Untrusted Inputs in a Security Decision

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

PT-2026-103814

Name of the Vulnerable Software and Affected Versions Ghost versions 0.5.0 through 6.22.9 Description A concurrency issue exists in the staff invitation acceptance mechanism. This race condition allows an attacker to create multiple user accounts using a single invitation token by submitting...

CentOS Linux 8.4 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1785161263)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1785161263 advisory. - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN...

GHSA-9V7F-9G4P-FFGJ PyJWT: PyJWKClient follows redirects when fetching JWKS

Summary PyJWT 2.13.0 PyJWKClient followed HTTP redirects while fetching a JWKS, without validating the redirect destination. A configured trusted endpoint could therefore redirect the client to a different host. Impact When an application uses PyJWKClient with caller-supplied request headers and ...

PyJWT: PyJWKClient follows redirects when fetching JWKS

Summary PyJWT 2.13.0 PyJWKClient followed HTTP redirects while fetching a JWKS, without validating the redirect destination. A configured trusted endpoint could therefore redirect the client to a different host. Impact When an application uses PyJWKClient with caller-supplied request headers and ...