CVE-2026-39999

Apache APISIX JWT Authentication Bypass, CVE-2026-39999 APISIX authentication bypass via JWT algorithm confusion, CVE-2026-39999

Apache APISIX JWT Authentication Bypass, CVE-2026-39999

Do Son July 8, 2026

TL;DR Apache APISIX 3.16.0 shipped a JWT algorithm confusion bug in its jwt-auth plugin. The flaw, tracked...

🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

CVE-2026-55255CVSS 8.4
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct...
CISA KEV📅 Added to KEV: Jul 7, 2026
CVE-2026-48908
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in...
CISA KEV📅 Added to KEV: Jul 7, 2026
CVE-2026-56290
The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable...
CISA KEV📅 Added to KEV: Jul 7, 2026
CVE-2026-20896CVSS 9.8
Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
Admin intel📅 Updated: Jul 6, 2026
CVE-2026-48282CVSS 10.0
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted...
Admin intelCISA KEV📅 Added to KEV: Jul 7, 2026📅 Updated: Jul 3, 2026
CVE-2024-14037CVSS 9.8
Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution...
Admin intel📅 Updated: Jul 3, 2026
CVE-2026-8451CVSS 8.8
Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured...
Admin intel📅 Updated: Jul 2, 2026
CVE-2026-8037CVSS 9.6
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to...
Admin intel📅 Updated: Jul 1, 2026

Critical Alert 4 Active Exploits Detected Today

Apache APISIX JWT Authentication Bypass, CVE-2026-39999