Linux Distros Unpatched Vulnerability : CVE-2026-62379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML...

EUVD-2026-78354

Open Access Management OpenAM is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implement...

CVE-2026-62379

OpenAM (Open Identity Platform) prior to 16.1.2 contains a pre-authentication remote code execution flaw in the /authservice PLL endpoint. The AuthXMLUtils.createCustomCallback method loads and instantiates an arbitrary Java class named in a XML element without verifying it implements DSAMECallb...

EUVD-2026-65468

A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: kots, atlantis, falcosidekick, fluent-bit-plugin-loki, splunk-otel-collector, authservice, gitea, oauth2-proxy...

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint /authservice, PLL accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the AuthXMLUtils.createCustomCallback process. An attacker can execute arbitrary code on the server by sending a crafted XML element to the /authservic...

PT-2026-64449

Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint /authservice, PLL accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is...

CVE-2026-42565

@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is...

GHSA-6F52-WPX2-HVF2 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, scorecard, hivemind, trillian, terraform-provider-azapi, kyverno-policy-reporter-ui, grpc-health-probe, fluent-bit-plugin-loki, steampipe, nri-haproxy, velero-plugin-for-microsoft-azure, petname, minify, doppler-kubernetes-operator, kuberlr,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: scorecard, hivemind, terraform-provider-azapi, kyverno-policy-reporter-ui, caddy, nri-haproxy, velero-plugin-for-microsoft-azure, petname, overmind, doppler-kubernetes-operator, cni-plugins, rabbitmq-cluster-operator, wgcf, newrelic-nri-kube-events, kpt, sbomqs,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: scorecard, hivemind, terraform-provider-azapi, kyverno-policy-reporter-ui, caddy, nri-haproxy, velero-plugin-for-microsoft-azure, petname, overmind, doppler-kubernetes-operator, cni-plugins, rabbitmq-cluster-operator, wgcf, newrelic-nri-kube-events, kpt, sbomqs,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, goreleaser, mage, rootlesskit, karpenter-fips, dgraph, terraform-provider-azapi-fips, containerd, flux-notification-controller-fips, govulncheck, containerd-fips, vault-k8s-fips, crane, openbao-fips, volume-modifier-for-k8s, snyk-cli,...

CVE-2019-13983

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...

CVE-2019-13983

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...

CVE-2019-13983

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...