CVE Intelligence
Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

Severity
Clear

5 result(s)

Export this search: RSS · CSV · STIX
CVE-2026-14916 High · 7.7 CWE-241 Sep 16, 2026
Kong API Gateway Enterprise: JWT Algorithm-Confusion
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for verification. As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability.
CVE-2026-73785 High · 7.5 CWE-241 Sep 11, 2026
HPE IceWall Federation Agent and Proxy, Denial of Service vulnerability
A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service (DoS).
CVE-2026-47110 Medium · 6.5 CWE-241 Jun 24, 2026
Tiptap for PHP < 2.1.1 DoS via Malformed href Attribute
Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(). Attackers can persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.
CVE-2025-63548 High · 7.5 CWE-241 May 1, 2026
An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a…
An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a packet specially crafted to bear a non-valid value in any Boolean field.
CVE-2025-66550 Medium · 5.7 CWE-241 Dec 5, 2025
Nextcloud Calendar attachments of local files are offered to downloaded
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.