Threat database

CVE-2026-77900 is a critical vulnerability in Microsoft Azure App Service for Linux where a missing authentication for a critical function allows unauthorized remote code execution. This flaw enables attackers to execute code over the network without any privileges or user interaction. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for this cloud service vulnerability.

CVE-2026-69435 is a critical Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure SRE Agent. It involves missing authorization controls that allow an authorized attacker to elevate privileges over a network. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality and integrity. Microsoft has issued an official fix for this cloud service vulnerability. There are no known exploits in the wild at this time.

CVE-2026-107728 is an incorrect authorization vulnerability in the strawberry-graphql library affecting versions from 0.217.0 up to but not including 0.326.1. The flaw occurs when a synchronous field resolver uses a custom permission whose has_permission() method is defined as a normal function returning an awaitable object. Because the awaitable is not awaited, its inherently truthy value incorrectly allows access to protected resolvers even when permission should be denied. This issue does not affect async has_permission() methods or synchronous permissions returning booleans. The vulnerability is fixed in version 0.326.1.

A resource consumption vulnerability exists in the legacy graphql-ws subscription handler of strawberry-graphql versions from 0.312.3 up to but not including 0.327.2. Completed subscription operations are not removed from internal tracking structures, allowing a client to exhaust the configured subscription slots on a persistent WebSocket connection. This causes legitimate new subscriptions to be rejected due to reaching the subscription limit. The issue does not affect the modern graphql-transport-ws protocol or deployments without per-connection subscription caps. The vulnerability is fixed in version 0.327.2.

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll, /account/protected/sub/delSub, or /message/updateAction to delete private messages and subscriptions or rename threads.

CVE-2026-107830 is a medium severity vulnerability in the banq jivejdon product. It involves a lack of rate limiting on the unauthenticated /account/smsVRAction endpoint, allowing attackers to send unlimited SMS messages. This can be exploited to harass arbitrary phone numbers and exhaust the Tencent Cloud SMS balance associated with the operator. The vulnerability affects versions of jivejdon from commit e0306088 through commit ee67a65e. No patch or remediation information is provided.

Jivejdon versions up to 5.0 use a weak password storage method by hashing passwords with unsalted MD5. This vulnerability allows attackers who gain database access or exploit SQL injection flaws to crack user passwords using precomputed tables or GPU-accelerated attacks.

Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina() sets the password to the first four digits of the Weibo ID, letting attackers log in through normal form login to read or post as victims.

Jivejdon versions up to 5.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can exploit this by uploading attachments with a malicious Content-Type, such as text/html, which the application serves inline. This allows execution of arbitrary JavaScript in the context of the application for users who view the shared link. The vulnerability has a medium severity with a CVSS score of 5.1.

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which ToolsUtil.convertURL() passes through unchanged, to execute code in the recipient's browser when opened.

Jivejdon versions up to 5.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can inject malicious scripts into forum message bodies, which are rendered without proper sanitization. This causes the script to execute in the browsers of users viewing the affected threads. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.

CVE-2026-107798 is a stored cross-site scripting (XSS) vulnerability in the banq jivejdon product. The flaw exists in the default-enabled TextStyle filter, which improperly neutralizes input by inserting unvalidated URLs into anchor href attributes. Authenticated attackers can exploit this by posting messages containing javascript: links or malformed URLs that break quoting, leading to JavaScript execution when other users interact with the links.

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.

Jivejdon contains a reflected cross-site scripting (XSS) vulnerability in the application/query/taggedThreadList.jsp page. This flaw allows unauthenticated attackers to inject malicious scripts via unencoded tagID and count parameters. The vulnerability is triggered when the 'start' parameter exceeds zero, enabling execution of arbitrary JavaScript in the victim's browser. The issue affects versions from commit 5489372d through commit ee67a65e. The CVSS 4.0 base score is 5.3, indicating medium severity.

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's subscriptionId to remove their thread, forum, tag or account subscriptions.

Jivejdon contains a missing authorization vulnerability in the UpdateThreadToForumAction component that allows authenticated users to move threads they do not own. By sending crafted threadId and forumId parameters to the /message/threadToForum/save endpoint, an attacker can relocate any reply-less thread to an arbitrary forum. This vulnerability affects versions of Jivejdon from commit d58a36b0 through commit ee67a65e. The issue has a medium severity with a CVSS 4.0 score of 5.3.

Jivejdon versions up to 5.0 contain an SQL injection vulnerability in the AccountDaoSql.getAccountByNameLike() function. Authenticated users with administrator privileges can exploit this flaw by injecting malicious SQL through the username parameter on the /admin/user/userListAction endpoint. This allows them to read sensitive database contents, including password hashes of other accounts. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level.

fast-jwt before version 6.3.0 improperly validates the type of JWT payloads, allowing JSON arrays to bypass claim checks such as expiry, issuer, audience, and replay protections. This occurs because the payload type check accepts arrays without rejecting them, causing configured claim validations to be skipped silently. The vulnerability is fixed in version 6.3.0.

fast-jwt versions from 6.2.0 up to but not including 6.3.0 contain a vulnerability where RSA public keys with non-whitespace content before the PEM header are misclassified as HMAC secrets. This misclassification allows an attacker who knows the public key bytes to forge HS256 signatures, potentially bypassing authentication or authorization. The issue is resolved in version 6.3.0.