Jwt

Apache APISIX `jwe-decrypt` Integrity-Check Bypass → Unauthenticated Gateway Auth Bypass (CVE-2026-49230) newCVE-2026-49230webCRITICAL 9.1Patched2026-07-27SimpleHelp OIDC Authentication Bypass via Unverified JWT Signature (CVE-2026-48558) new KEV EPSS 12%CVE-2026-48558webCRITICAL 10Patched2026-07-19Flowise Enterprise Authentication Bypass via Hardcoded Default JWT Secrets (CVE-2026-56271) newCVE-2026-56271webCRITICAL 9.8Patched2026-07-12WordPress Mobile Builder Plugin JWT Authentication Bypass to Admin Account Creation (CVE-2025-68860) newCVE-2025-68860webCRITICAL 9.8Unpatched2026-07-06Squid Proxy Sensitive Header Leak via Error Page `mailto:` Diagnostic Block (CVE-2025-62168) new EPSS 63%CVE-2025-62168networkCRITICAL 10Patched2026-07-06RestroPress WordPress Plugin Unauthenticated Information Exposure Leading to JWT Forgery / Account Takeover (CVE-2025-9209) newCVE-2025-9209webCRITICAL 9.8Unpatched2026-07-06SimpleHelp OIDC Authentication Bypass (CVE-2026-48558) new KEV EPSS 12%CVE-2026-48558webCRITICAL 9.8Patched2026-07-05sealed-env Unseal Token TOTP/Enterprise Secret Disclosure (CVE-2026-45091) newCVE-2026-45091cryptoHIGHPatched2026-07-05pac4j JWT Authentication Bypass via Unsigned Token in JWE Wrapper — CVE-2026-29000 newCVE-2026-29000webCRITICAL 9.8Patched2026-07-05Nextcloud user_oidc ID4me JWT Signature Bypass (CVE-2026-45156) newCVE-2026-45156webHIGH 8.1Patched2026-07-05LiteLLM Authentication Bypass via OIDC Userinfo Cache Key Collision (CVE-2026-35030) newCVE-2026-35030webCRITICAL 9.1Patched2026-07-05Lightspeed Classroom Management Weak Authentication / Device Takeover — CVE-2026-30368 newCVE-2026-30368webHIGHUnverified2026-07-05Keycloak Unauthorized Organization Registration via Invitation Token Flaw — CVE-2026-1529 newCVE-2026-1529webCRITICALUnverified2026-07-05