MAL-2026-17794 Malicious code in seed-phrase-validator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb8d12a066c24d672bf16efe57267c46c727592ee21beb0e2accb3bb6e4bfb3a The gem declares a native extension but ships no C/C++/Rust source. extconf.rb exists solely to execute at gem install time. It decodes a...

arp-validator

arp-validator Herramienta de seguridad para detectar ataques de envenenamiento ARP Características Utiliza un enfoque más rápido en la detección de ataques de envenenamiento ARP en comparación con enfoques pasivos Detecta no solo la presencia de envenenamiento ARP sino también el mapeo IP-MAC...

GHSA-687G-22H4-J4W4 fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

Summary createVerifier clockTolerance: Infinity silently bypasses both exp expiry AND nbf not-before validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier's internal cache so cached entries inherit infinite validity — they remain valid...

NPM: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

NPM: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.4...

GHSA-5HJW-83FP-PHQ9 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

Summary fast-jwt's createVerifier silently skips all configured claim validators exp, nbf, iss, aud, sub, jti, nonce when a validly-signed JWT carries a JSON array as its payload instead of an object. The verifier reports success while having enforced only the signature. This breaks the library's...

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

Summary fast-jwt's createVerifier silently skips all configured claim validators exp, nbf, iss, aud, sub, jti, nonce when a validly-signed JWT carries a JSON array as its payload instead of an object. The verifier reports success while having enforced only the signature. This breaks the library's...

CVE-2026-107723 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

CVE-2026-107723

The fast-jwt library (versions prior to 6.3.0 ) is vulnerable to a silent claim-validator bypass when a JWT payload is a JSON array . The root cause is located in src/decoder.js, where the system verifies that the payload is an object but fails to reject arrays. Because the claim validator loop l...

CVE-2026-107723 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

EUVD-2026-95348

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

CVE-2026-107723 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

CVE-2026-96890

A Server-Side Request Forgery (SSRF) vulnerability exists in GitHub Enterprise Server (versions 3.20, 3.21, and 3.22). The flaw stems from the secret scanning validator for GCP service account credentials , which trusted the token endpoint embedded in a committed credential and issued requests wi...

CVE-2026-96890 Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

CVE-2026-96890 Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

CVE-2026-96890: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

PT-2026-107128

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.20 through 3.20.8 GitHub Enterprise Server versions 3.21 through 3.21.6 GitHub Enterprise Server versions 3.22 through 3.22.1 Description A Server-Side Request Forgery SSRF issue exists where the secret...

Astra Linux – Vulnerability in node-ajv

The ajv Another JSON Schema Validator before version 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax $data reference, which is passed directly to the JavaScript RegExp constructor...

Astra Linux – Vulnerability in symfony

symfony/validator is a module for the Symphony PHP framework that provides tools for validating values. It’s possible to trick a Validator configured with a regular expression using the $ metacharacter, especially when the input ends with \n. Starting from versions 5.4.43, 6.4.11, and 7.1.4,...