CVE Watchtower

The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A ...

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores ...

When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles ass...

The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web a...

After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes wh...

When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always c...

When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared...

The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user n...

The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login d...

Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to de...

OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 1...

Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute ar...

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privilege...

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privilege...

Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user�...

A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to...

An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local...

### Summary RSASSA-PKCS1-v1_5 signature verification (`publicKey.verify()` with the default scheme, also used by X.509 certificate and PKCS#7 verifica...