CVE-2026-55165

In Lemur 1.9.0 and earlier, lemur/auth/service.py:130-137 reads the alg field from an unverified JWT header and passes it to pyjwt.decode(..., algorithms=[header_data["alg"]]), letting an attacker choose the verification algorithm. PyJWT 2.x blocks alg=none, so direct ATO requires a separate LEMU...

CVE-2026-63335

creationtimestamp| type| source ---|---|--- 2026-08-18 18:35:15+00:00| published-proof-of-concept| https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-qx7j-jv8m-fppr...

CVE-2025-9210

Otalio Ship Property Management System versions before 2.22.0 fail to validate JSON Web Token signatures, allowing authenticated attackers to tamper with JWTs and escalate privileges. CVSS 3.1 scores 8.1 HIGH (network vector, low complexity, low privileges required, high confidentiality/integrity...

CVE-2025-9210 Missing JSON Web Token signature validation in Otalio Ship Property Management System

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs...

CVE-2025-9210 Missing JSON Web Token signature validation in Otalio Ship Property Management System

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs...

CVE-2026-71878

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71879

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

EUVD-2026-61105

NVIDIA NVOS for network switches contains a vulnerability in the secure shell SSH server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommende...

CVE-2026-24185

NVIDIA NVOS for network switches contains a vulnerability in the secure shell SSH server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommende...

CVE-2026-24185

NVIDIA NVOS network switches in PKA-only mode allow an admin to inadvertently enable an alternative SSH authentication path; if NVIDIA's default-password replacement guidance is ignored, unauthorized access and privilege escalation may result. CVSS 7.1 HIGH (adjacent vector, high confidentiality/...

GHSA-3P54-567P-2WPR MobSF's CSRF checks not enforced after Django migration

Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71879

GBIF Integrated Publishing Toolkit versions before 3.3.4 leave initial setup functionality unauthenticated until first reboot, allowing remote authenticated attackers to bypass authentication and gain administrative control. CVSS 4.0 scores it 9.1 CRITICAL (network, low complexity, no privileges ...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

EUVD-2026-61130

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878

GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 leaves initial setup functionality exposed after setup completion, enabling remote authenticated attackers to bypass authentication and gain administrative control; CVSS 4.0 scores this CRITICAL (9.2), with a fix available in version 3...