325 matches found
ape-volo-admin <= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Key
ape-volo-admin 3.6.1 contains an authentication bypass caused by a hardcoded JWT signing key in appsettings.json, letting unauthenticated attackers forge administrator tokens and gain full API control, exploit requires knowledge of the hardcoded key. id: CVE-2026-120442 info: name: ape-volo-admin...
CVE-2026-125104
A flaw was found in FFmpeg. A memory exhaustion issue can occur in the APE Monkey's Audio decoder when decoding specially crafted legacy APE audio files due to a failure to enforce the sample limit on frame sizes. This vulnerability can lead to an excessive consumption of memory resources,...
CVE-2026-125104 FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c
FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in apedecodeframe in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale...
PT-2026-140997
FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape decode frame in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale...
CVE-2026-120442
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain fu...
CVE-2026-120442 ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain fu...
EUVD-2026-115202
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain fu...
CVE-2026-120442
The ape-volo-admin software (versions before 3.6.1 ) is vulnerable to an authentication bypass due to a hardcoded JWT signing key located in the appsettings.json file. This flaw allows unauthenticated attackers to sign tokens offline. By setting the jti claim to the seeded administrator ID, attac...
CVE-2026-120442 ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain fu...
PT-2026-135458
Name of the Vulnerable Software and Affected Versions ape-volo-admin versions prior to 3.6.1 Description An authentication bypass exists that allows unauthenticated attackers to forge administrator tokens. This is possible due to a hardcoded JWT JSON Web Token signing key located in the...
CVE-2026-120442: xianhc ape-volo-admin: ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to…
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain fu...
Malicious code in isolated-silver-ape (npm)
Source: amazon-inspector c1bf3579bf50d1c12a6fa36e149c314108aba643f652b64a8de0ac59cf18e589 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in inc-turquoise-ape (npm)
Source: amazon-inspector af907267455f9fcbbcb270b63e8144b808f98c148adbcc29c881673fcb807f16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in given-amaranth-ape (npm)
Source: amazon-inspector 07c2d5761d03950ea05f7c85692de994e4d003d1fd15816f8f63ef94e134c26c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in envious-lime-ape (npm)
Source: amazon-inspector a38fec78d3735b58ee0cf18e6bda2a2188bbdfb9c911ae3ad3d4782e365220a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in embarrassed-plum-ape (npm)
Source: amazon-inspector 4eb020e40af0d4d4d98a23ac0f24edf4120b4a47b4ec8e83e4b443e6df0eb15b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in confidential-olive-ape (npm)
Source: amazon-inspector 9281542f8009b505d9d5b7fd5f3a0819908f11d3d2696f0b649ce0035df09849 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in coming-turquoise-ape (npm)
Source: amazon-inspector 37de3792cdc24173b7d3529c6f3e5c040f215c6e2904cdc9b676089e08b9d82e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in beautiful-aqua-ape (npm)
Source: amazon-inspector 0a424d41f787c05f8cbb4e298c07d7471bf5a992e1327393bee861e2529354ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...