malach-it

Products

Product	CVEs	Exploited	Latest
boruta	3	–	Jul 30, 2026
boruta-server	3	–	Sep 2, 2026

CVE-2026-49249 High 7.1 Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2 0.4%
CVE-2026-55221 Medium 6.5 Boruta: OAuth credentials exposed in Boruta business logs 0.5%
CVE-2026-53431 Critical 9.1 Boruta accepts expired JWT client assertions due to missing exp claim validation 0.5%
CVE-2026-65635 High 8.3 Boruta dynamic client registration allows creation of over-privileged OAuth clients 0.4%
CVE-2026-54885 Medium 6.9 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching 0.5%
CVE-2026-53661 High 8.8 boruta-server sent sensitive session cookies without the Secure attribute 0.3%