EUVD-2026-62417

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...

CVE-2026-71960

Cudy WR3000 2.0 firmware before 2.5.24 ships a hard-coded JWT HMAC signing secret in its Mosquitto MQTT broker authentication plugin. Attackers can extract the secret from the firmware image to forge valid JWT tokens, bypassing authentication to the device's mesh networking interface with CVSS 9....

CVE-2026-71960 Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...

CVE-2026-76216

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-50149

Contour (Kubernetes ingress controller using Envoy proxy) versions 1.23.0 through 1.33.4 contain a JWT verification bypass . When an HTTPProxy resource is configured with both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour accepts the incompatibl...

EUVD-2026-62414

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-76216

Vikunja through 2.4.0 is affected by a principal-type confusion vulnerability. Three permission checks lack type guards, causing LinkSharing principals with id N to be incorrectly treated as user principals where users.id == N. An attacker holding a valid link-share JWT can exploit id collisions ...

EUVD-2026-62457

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

RDK-B WebUI contains multiple vulnerabilities

Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication,...

PT-2026-78446

Name of the Vulnerable Software and Affected Versions Cudy WR3000 2.0 versions prior to 2.5.24 Description The Mosquitto MQTT broker authentication plugin contains a hard-coded JWT HMAC signing secret. This allows unauthenticated attackers to extract the secret from the firmware image and forge...

CVE-2026-65984

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js...

CVE-2026-65984

FUXA (web-based SCADA/HMI/Dashboard software) versions 1.3.2 and earlier contain a JWT lifecycle flaw in two endpoints: POST /api/refresh in server/api/auth/index.js falls back to decoded.groups when the user record is missing or groups is zero, and POST /api/heartbeat in server/api/index.js re-s...

CVE-2026-65984 FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js...

CVE-2026-65984 FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js...

CVE-2026-67443 FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

CVE-2026-67443

In FUXA ≤1.3.2, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity, so an unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and access the RED.httpAdmin editor. Wi...