Known Vulnerabilities for Sa-token by Dromara
Listed below are 2 of the newest known vulnerabilities associated with "Sa-token" by "Dromara".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-58449 json | txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved thr... | Not Provided | 2026-06-30 | 2026-07-01 |
| CVE-2026-58446 json | Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (... | Not Provided | 2026-06-30 | 2026-07-01 |
| CVE-2026-58399 json | @acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenti... | Not Provided | 2026-07-01 | 2026-07-01 |
| CVE-2026-58169 json | Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypas... | Not Provided | 2026-06-30 | 2026-07-01 |
| CVE-2026-58165 json | OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-... | Not Provided | 2026-06-30 | 2026-07-01 |
| CVE-2026-57948 json | Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinp... | Not Provided | 2026-06-29 | 2026-07-02 |
| CVE-2026-57522 json | Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), whi... | Not Provided | 2026-06-25 | 2026-06-26 |
| CVE-2026-57289 json | Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname va... | Not Provided | 2026-06-24 | 2026-06-24 |
| CVE-2026-56768 json | Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthentica... | Not Provided | 2026-06-25 | 2026-06-30 |
| CVE-2026-56018 json | JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growt... | Not Provided | 2026-06-29 | 2026-06-29 |