92388 matches found
JetBrains TeamCity < 2020.2 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2020.2. It is, therefore, affected by multiple vulnerabilities: - JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages. CVE-2021-25773 - In JetBrains TeamCity before 2020.2, an ECR token could ...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation through the JWTClaimsRegistry in src/joserfc/rfc7519/claims.py. An attacker can make a JWT with an array-typed iss claim pass an exact-issuer check by supplying a list that contains the expected issuer string...
CVE-2026-77337
Removed by vendor...
CVE-2026-77337
CakePHP Authentication (a plugin for CakePHP and PSR-7 based applications) is affected by a critical vulnerability (CVSS 4.0: 9.1 ) in the CookieAuthenticator component. When legacy tokens are used, they are unencrypted and forgeable , enabling authentication bypass and potential CPU or memory ex...
CVE-2026-75542
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...
CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
EEF-CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
Summary Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicit...
EUVD-2026-65120
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
CVE-2026-75554
CVE-2026-75554 is an Insufficient Session Expiration vulnerability in the OAuth token refresh grant of hex.pm (the Hackage Package Manager). The root cause lies in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal repositories scope. Explicitly granted repos...
CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
CVE-2026-75542
CVE-2026-75542 is an Incorrect Authorization flaw in the OAuth token endpoint of hex.pm (the Erlang/BEAM package registry). When an API key holding the repositories permission is exchanged for a token via the client_credentials grant, the function validate_scopes_against_key/2 in lib/hexpm_web/co...
CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...
CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...
CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...
EEF-CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access
Summary Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant,...
MAL-2026-14425 Malicious code in auth-otp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72292101c6b448dbaea5dc1e2af91cc55b35b32ee1e722c4f5b21dfb91e032d Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs node lib/core.js --setup as a postinstall lifecycle script...
CVE-2026-66908
The Apache Camel Platform HTTP Main component (versions 4.8.0 to before 4.22.0) contains an improper authentication vulnerability. When JWT authentication is enabled with a keystore but without jwtIssuer or jwtAudience configurations, the camel-main embedded HTTP server fails to validate the iss ...
CVE-2026-66908 Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...
EUVD-2026-64959
Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...