malach-it vulnerabilities

Newest CVEs

• CVE-2026-49249

  Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2

  malach-it · boruta-server

  High7.1
• CVE-2026-55221

  Boruta: OAuth credentials exposed in Boruta business logs

  malach-it · boruta-server

  Medium6.5
• CVE-2026-53431

  Boruta accepts expired JWT client assertions due to missing exp claim validation

  malach-it · boruta

  Critical9.1
• CVE-2026-65635

  Boruta dynamic client registration allows creation of over-privileged OAuth clients

  malach-it · boruta

  High8.3
• CVE-2026-54885

  Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching

  malach-it · boruta

  Medium6.9
• CVE-2026-53661

  boruta-server sent sensitive session cookies without the Secure attribute

  malach-it · boruta-server

  High8.8