A couple more from recent history:

https://insomniasec.com/blog/auth0-jwt-validation-bypass https://auth0.com/blog/critical-vulnerabilities-in-json-web-...