Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

CVE-2026-49998

#### Summary Centrifugo's dynamic JWKS endpoint feature can verify a JWT for one allowed issuer using a public key cach

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController:...

CVE-2026-57995

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GR

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts...

CVE-2026-56320

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_i

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist...

CVE-2026-56328

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unn

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion...

CVE-2026-56286

Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows delet

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation...

CVE-2026-56249

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authen

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and...

CVE-2026-56300

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey th

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that...

CVE-2026-56233

Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated user

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without...

CVE-2026-56247

Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compa

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey...

CVE-2026-56230

Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the cli

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public...

CVE-2026-56219

Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that all

历史摘要 · 未重新核验 · GitHub Advisory

Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles

CVE-2025-10996

### Summary A memory-safety vulnerability in Open Babel's SMILES parser caused a heap buffer overflow when reading a cr

历史摘要 · 未重新核验 · GitHub Advisory

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

CVE-2026-49478

## Impact Three security vulnerabilities were identified in the OIDC Discovery client: 1. **Blind Server-Side Request

历史摘要 · 未重新核验 · GitHub Advisory

@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754

CVE-2026-48795

### Summary The fix for [GHSA-f5x2-vj4h-vg4c](https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c)

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

CVE-2026-49824

### Summary The Fission Function admission webhook (`pkg/webhook/function.go`) validated that `spec.secrets[].namespace

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

CVE-2026-49823

### Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance

CVE-2026-49822

### Summary A low-privilege developer who could create a `KubernetesWatchTrigger` (KWT) in their own namespace was able

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

CVE-2026-49821

### Summary Fission's `buildermgr` controller processed `Package` CRDs without verifying that `Package.spec.environment

历史摘要 · 未重新核验 · GitHub Advisory

Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec

### Summary The Fission MessageQueueTrigger (MQT) scaler controller exposed two privilege-escalation primitives to any

历史摘要 · 未重新核验 · GitHub Advisory

@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

CVE-2026-49473

### Summary @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar auth

历史摘要 · 未重新核验 · GitHub Advisory