https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 10:31:48 +0000 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1165 https://vulnerability.circl.lu/vuln/cleanstart-2026-cj91094 <p><strong>Affected:</strong> CleanStart: apache-nifi</p> <p>Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: apache-nifi</p> <p>Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details.</p> https://vulnerability.circl.lu/vuln/cleanstart-2026-cj91094 https://vulnerability.circl.lu/vuln/fkie_cve-2026-41707 <p>Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security&#39;s DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.</p> <p>This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.</p> <p>Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security&#39;s DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.</p> <p>This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-41707 https://vulnerability.circl.lu/vuln/ghsa-3488-4mh8-47j4 <p>Spring Security&#39;s DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11</p> <p>Spring Security&#39;s DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11</p> https://vulnerability.circl.lu/vuln/ghsa-3488-4mh8-47j4