Most recent entries from all

certfr-2026-avi-0112 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-0112

CLEANSTART-2026-FE11294 — Security fix for CVE-2025-65945 applied in: jitsucom-jitsu 2.11.0-r0

Affected: CleanStart: jitsucom-jitsu

Security vulnerability affects the jitsucom-jitsu package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-262671

fkie_cve-2025-65945

auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.

GHSA-869p-cjfg-cm3x — auth0/node-jws Improperly Verifies HMAC Signature

Affected: npm: jws

### Overview An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions.

### Am I Affected? You are affected by this vulnerability if you meet all of the following preconditions:

1. Application uses the auth0/node-jws implementation of JSON Web Signatures, versions <=3.2.2 || 4.0.0 2. Application uses the jws.createVerify() function for HMAC algorithms 3. Application uses user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines

You are NOT affected by this vulnerability if you meet any of the following preconditions: 1. Application uses the jws.verify() interface (note: `auth0/node-jsonwebtoken` users fall into this category and are therefore NOT affected by this vulnerability) 2. Application uses only asymmetric algorithms (e.g. RS256) 3. Application doesn’t use user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines

### Fix Upgrade auth0/node-jws version to version 3.2.3 or 4.0.1

### Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

RHSA-2026:0261 — Red Hat Security Advisory: Red Hat Developer Hub 1.7.4 release.

node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications qs: qs: Denial of Service via improper input validation in array parsing glob: glob: Command Injection Vulnerability via Malicious Filenames node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm node-forge: node-forge ASN.1 Unbounded Recursion

WID-SEC-W-2025-2909 — IBM App Connect Enterprise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.