CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-107722

The fast-jwt library (versions 6.2.0 to 6.3.0 ) is vulnerable to RSA→HS256 algorithm confusion due to an incomplete patch of CVE-2026-34950. The root cause resides in src/crypto.js, where performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored. This allows...

CVE-2026-107722

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-87796

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-87796 CVE-2026-87796 Multi Uploader for Gravity Forms 1.1.9 - sh1zen I am @abraxasnull. Loopback lab. The client is CVE-2026-87796-Abraxas-Labs.py. The advisory named a method. movefile is a private PHP...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.3 Vulnerability Details CVEID:CVE-2026-59270 DESCRIPTION: Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all...

Security Bulletin: This Power System update is being released to address CVE-2026-6727

Summary The PowerVM Virtual Trusted Platform Module vTPM feature is impacted by the referenced vulnerability. Vulnerability Details CVEID:CVE-2026-6727 DESCRIPTION: A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the...

Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities

Summary The Planning Analytics Workspace component of IBM Planning Analytics is affected by security vulnerabilities. These vulnerabilities have been addressed in IBM Planning Analytics Local v2.0 - IBM Planning Analytics Workspace version 2.1.24. Vulnerability Details CVEID:CVE-2026-75063...

aws-inventory

Introduction Cet outil tente de découvrir toutes les ressources AWS créées dans un compte. AWS possède de nombreux produits également appelés services, avec de nouveaux ajoutés en permanence et des produits existants enrichis de nouvelles fonctionnalités. L'écosystème permet aux utilisateurs de...

detaped

Detaped مقدمة Detaped هو مفكك تركيبة disassembler وفك مترجم decompiler بلغة بايثون لـ Duktape GitHub. الاستخدام المقصود هو لمراجعة وتحليل الكود المصدري في الحالات التي يتوفر لديك فيها فقط ملف ثنائي من البايت كود المُجمَّع الخاص بـ Duktape، مثل تقييم الصندوق الأسود black-box assessment. الميزات يح...

CVE-2025-65321

CVE-2025-65321 بوت Discord الخاص بـ Language Sloth عرضة لثغرة اجتياز الدليل Directory Traversal في الدالتين gif و png. تقوم الدالتان ببناء مسارات الملفات باستخدام مدخلات المستخدم غير المنقاة للمعامل name، مما يسمح للمهاجمين بالإشارة إلى ملفات خارج أدلة الموارد المخصصة. الدالتان gif و png في الملف...

Cybersecurity Imperatives Will Demand AI Math

" I think we might lose public key cryptography." Matthew Green The above is from Matthew Green, yesterday, who is a cryptographer at Johns Hopkins. OpenAI released over 700 mathematical proofs as a github repository yesterday. They've since withdrawn 3 of them. The reaction from mathematicians h...

K000163608: Python vulnerability CVE-2026-0994

Security Advisory Description A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal...

SecretScrub

SecretScrub SecretScrub éliminera tous vos sales secrets codés en dur. Ce script traite les fichiers au format SARIF, généré par divers outils d'analyse statique. L'outil analyse un répertoire du système de fichiers, masque toutes les occurrences de secrets détectées dans les fichiers SARIF dans...

Exploit for CVE-2026-91940

CVE-2026-91940: arbitrary file write in crawl4ai through the u...

CVE-2026-23499

CVE-2026-23499: Saleor عرضة لثغرة XSS المخزّنة عبر رفع ملفات غير مقيد نظرة عامة الحقل| التفاصيل ---|--- معرف CVE| CVE-2026-23499 درجة الخطورة| HIGH النشرة الأمنية| عرض النشرة الأمنية اكتشف بواسطة| Lukasz Rybak المنتجات المتأثرة saleor/saleor التفاصيل سمح Saleor للمستخدمين الموظفين الموثّقين أو...

CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

أداة استغلال ثغرة CVE-2026-1529 في Keycloak Keycloak: تسجيل مؤسسة غير مصرح به عبر التحقق غير السليم من رمز الدعوة إخلاء مسؤولية هذه الأداة لأغراض تعليمية واختبار الأمان فقط. استخدمها فقط على الأنظمة التي لديك إذن صريح لاختبارها. الوصول غير المصرح به إلى أنظمة الكمبيوتر غير قانوني وغير أخلاقي. مؤل...

Post-quantum authentication: Why organizations should start testing certificate ecosystems now

In this article 1. Why post-quantum authentication presents a different challenge 2. Why organizations should begin preparing now 3. Microsoft's perspective on readiness 4. Testing the future certificate ecosystem 5. Expanding end-to-end testing 6. What organizations can do today 7. Looking ahead...

o1js-scan

o1js-scan Paquet communautaire : o1js-scan est référencé dans le répertoire officiel o1js Community Packages. Dernière version : 0.22.0 — un serveur MCP local permet à Claude Code, Cursor et autres assistants de codage IA d'exécuter le scanner pendant que vous écrivez une zkApp : pip install...

GuardModel

GuardModel Block malicious AI models in your pipeline with one line of YAML. GuardModel is a GitHub Action that automatically scans ML model files for malicious code, vulnerabilities, and security risks in CI/CD pipelines. It blocks dangerous models before they reach production by detecting pickl...