[{"data":1,"prerenderedAt":57},["ShallowReactive",2],{"sicherheitsluecke-cve-2026-114615":3},{"l":4,"details":26,"weitere":36,"indexierbar":55,"updated":56},{"cve":5,"status":6,"vendor":7,"product":7,"name":8,"added":9,"due":8,"ransomware":10,"published":9,"cwes":11,"cvss":14,"epss":19,"slug":22,"bereich":23,"schweregrad":24,"art":25,"produktLabel":7},"CVE-2026-114615","gemeldet","Authlib","","2026-10-22",false,[12,13],"CWE-184","CWE-347",{"version":15,"score":16,"severity":17,"vector":18},"3.1",9.1,"CRITICAL","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",{"score":20,"percentile":21},0.00213,0.11664,"cve-2026-114615","dev","kritisch","Unvollständige Sperrliste",{"description":27,"refs":28},"Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib\u002Fjose\u002Frfc7518\u002Foct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.",[29,32,34],{"url":30,"host":31},"https:\u002F\u002Fgithub.com\u002Fauthlib\u002Fauthlib\u002Fcommit\u002Fe3bd41cb29dcfee434453b135ffb487884baeedf","github.com",{"url":33,"host":31},"https:\u002F\u002Fgithub.com\u002Fauthlib\u002Fauthlib\u002Fpull\u002F945",{"url":35,"host":31},"https:\u002F\u002Fgithub.com\u002Fauthlib\u002Fauthlib\u002Fsecurity\u002Fadvisories\u002FGHSA-7vr2-2fgp-9w7p",[37,45,51],{"cve":38,"status":6,"produktLabel":39,"vendor":40,"product":41,"art":42,"bereich":23,"schweregrad":24,"score":43,"epss":-1,"added":44,"ransomware":10},"CVE-2026-120779","Microsoft Visual Studio Code","Microsoft","Visual Studio Code","Einschleusen von Programmcode (Code Injection)",9.6,"2026-11-10",{"cve":46,"status":6,"produktLabel":47,"vendor":8,"product":47,"art":48,"bereich":23,"schweregrad":24,"score":49,"epss":50,"added":44,"ransomware":10},"CVE-2026-125370","Kubero","Fest eingebauter Schlüssel für die Verschlüsselung",9.3,0.00683,{"cve":52,"status":6,"produktLabel":53,"vendor":8,"product":53,"art":54,"bereich":23,"schweregrad":24,"score":16,"epss":-1,"added":44,"ransomware":10},"CVE-2026-125758","Aptabase","Unsichere Standardeinstellung",true,"2026-11-11T14:28:43.107Z",1794407353524]