CVE-2026-114618

The Authlib Python library (prior to version 1.9.0 ) is vulnerable due to an insecure default in the RFC 7523 JWTBearerGrant.get_audiences() method. Because this method returns an empty list by default, JWTBearerGrant.verify_claims() only requires the presence of an aud claim without verifying it...

CVE-2026-114618 Authlib: Default JWT bearer grant accepts assertions for the wrong audience

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...

CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...

CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...

CVE-2026-101777

A flaw was found in the MySQL security encryption component. A remote attacker with high privileges can exploit this vulnerability over network protocols to cause the service to hang or crash repeatedly, resulting in a complete Denial of Service DoS. Additionally, successful exploitation can allo...

CVE-2026-101513

A flaw was found in the InnoDB component of MySQL. An attacker with physical access and high privileges can exploit this vulnerability to cause the system to hang or crash repeatedly. Successful exploitation results in a complete Denial of Service DoS of the database cluster...

CVE-2026-114732

A flaw was found in Roundcube Webmail. In multi-host installations, user authentication using an alias address does not restrict account lookup to the specific Internet Message Access Protocol IMAP host. A remote authenticated user could exploit this flaw to gain unauthorized access to another...

CVE-2026-90458

A path traversal vulnerability was found in OpenStack Ironic Redfish vendor passthrough subscription management. An authenticated attacker with vendor passthrough privileges could use a crafted subscription id to access or delete arbitrary Redfish resources on a node's BMC. Mitigation There is no...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing wildcard or path segments, which causes explicit deny rules to be...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing wildcard or path segments, which causes explicit deny rules to be...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing wildcard or path segments, which causes explicit deny rules to be...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing wildcard or path segments, which causes explicit deny rules to be...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to improper expiration checks in the AppRole authentication process. An attacker can gain unauthorized access by using an expired Secret ID that has not yet been removed by the periodic tidy operation...

Incorrect Authorization

Overview github.com/openbao/openbao/v2/internal/vault/policy is a None Affected versions of this package are vulnerable to Incorrect Authorization. via the policy cache authorization process. An attacker can gain unauthorized access to capabilities in other namespaces, including the root namespac...

CVE-2026-108398

A flaw was found in .NET Framework. An untrusted search path vulnerability allows an authenticated local attacker to bypass security features. By placing a malicious file in a search directory used by the application, an attacker can trick the system into loading unauthorized resources, potential...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty's HTTP/3 codec

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty's HTTP/3 codec. Netty is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-100659 DESCRIPTION:...

CVE-2026-95720

A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network...

CVE-2026-95721

A memory corruption vulnerability exists in the web-based management interface of AOS-8. Successful exploitation could allow an authenticated low privilege attacker with local access to view some system files and interrupt the normal operation of the affected service...

CVE-2026-79874

An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data...

CVE-2026-79868

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or...