CVE-2026-10579 Picketlink-federation: auth bypass in picketlink saml unsolicited-response

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...

CVE-2026-10579

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...

Security Bulletin: Vulnerability in SSSD affects IBM Netezza Appliance

Summary The SSSD package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-14476 Vulnerability Details CVEID:CVE-2026-14476 DESCRIPTION: A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not...

CVE-2026-6181

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

CVE-2026-6181

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

EUVD-2026-55962

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

CVE-2026-6181

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

CVE-2026-6181

The CVE-2026-6181 entry concerns the Device Configuration Framework. Vulnerability: authentication bypass achievable after an attacker authenticates with a viewer-privileged service account. Root cause: flawed auth logic permitting bypass once logged in with a high-privilege viewer account. Impac...

EUVD-2026-55929

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

GHSA-GM37-52C6-37MW vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-67422 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-59937 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-59936 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-66775

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

CVE-2026-66773

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

EUVD-2025-210673

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid...

EUVD-2025-210672

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

EUVD-2026-55887

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

CVE-2026-66775

CVE-2026-66775 affects SAP Approuter (SAP Business AI Platform). The vulnerability is a CSRF flaw where cross-site request forgery protection is not enforced on the authentication flow by default. An unauthenticated attacker could craft a malicious link to lure a victim and bind the victim’s sess...

EUVD-2026-55885

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...