DEBIAN-CVE-2026-80179

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

CVE-2026-80179

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

CVE-2026-76945

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

CVE-2026-76179

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

UBUNTU-CVE-2026-80179

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

CVE-2026-80179

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

CVE-2026-39944

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

Security Bulletin: Security Vulnerability in Nimbus Jose JWT Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-53864)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Nimbus Jose JWT Vulnerability Details CVEID:CVE-2025-53864 DESCRIPTION: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a...

PT-2026-83258

Name of the Vulnerable Software and Affected Versions SpringBlade versions 2.7.3 through 4.9.9 Description Authenticated attackers can escalate privileges to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via...

PT-2026-83281

Name of the Vulnerable Software and Affected Versions Flextype CMS versions prior to 1.0.0-dev Description An expression language injection exists that allows authenticated attackers with a valid API token to read arbitrary files. This occurs when unsanitized user input is passed to the Symfony...

PT-2026-83227

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.19 Description A time-of-check/time-of-use TOCTOU issue exists in the marketplace settlement process. While the system ensures that the combined referral and royalty percentages do not exceed 100% at the time of...

PT-2026-83350

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 6.3.12 Graylog versions prior to 7.0.7 Graylog versions prior to 7.1.2 Description An insecure direct object reference IDOR exists in the token revocation process. An authenticated user can delete access tokens...

Linux Distros Unpatched Vulnerability : CVE-2026-80179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed...

PT-2026-83064

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An authentication flaw exists where remote token validation paths fail to enforce configured authorization policies when multiple scopes are required. An attacker possessing an OAuth2 token with...

PT-2026-83116

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

PT-2026-83170

Name of the Vulnerable Software and Affected Versions Hatchet versions 0.40.0 through 0.91.0 Description The Dispatcher gRPC service fails to verify if a request's worker ID belongs to the tenant identified by the bearer-token context. This occurs within the Dispatcher/UpsertWorkerLabels and...

CVE-2026-82282: Missing Authentication for Critical Function

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-40205: Improper Authentication

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

CVE-2026-40205

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

UBUNTU-CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...