These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-65635 is an Improper Isolation or Compartmentalization vulnerability in the Elixir.Boruta.Openid module of the malach-it boruta library. This vulnerability allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. The affected product is boruta, with versions from 2.3.0 before 2.3.7 being vulnerable. The likely operatio [truncated]
A Server-Side Request Forgery (SSRF) vulnerability exists in the malach-it Boruta OAuth/OpenID authorization server. This allows an unauthenticated remote attacker to cause the server to issue outbound HTTP requests to attacker-chosen URIs, potentially targeting internal services and cloud metadata endpoints. The issue arises from three code paths that fetch remote URIs without sufficient validation. This [truncated]
CVE-2026-53661 is a high-severity vulnerability in the Boruta authorization server. Prior to version 0.9.1, Boruta's session cookies and remember-me cookie were set without the Secure attribute. This allowed potential attackers to intercept these cookies over an unencrypted connection if users accessed the same Boruta origin over plaintext HTTP. An attacker could then reuse a valid session or remember-me [truncated]