https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T11:43:36.572525+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-103055 fkie_cve-2026-103055 2026-10-01T11:43:36.602678+00:00

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints.

 https://vulnerability.circl.lu/vuln/ghsa-j6w5-vmvx-vgrp GHSA-j6w5-vmvx-vgrp 2026-10-01T11:43:36.602788+00:00

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints.