CVE-2026-75488

Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS to corrupt stack memory via oversized credentials. Attackers controlling the ACS can send Username and Password values up to 256 bytes in TR-069 Download or Upload requests,...

CVE_2022_3141

CVE-2022-3141: SQL Injection in ACS EDU 3rd Generation This repository contains a detailed security analysis and report for the vulnerability identified as CVE-2022-3141, affecting the ACS EDU 3rd Generation smart-card system. Vulnerability Overview CVE ID : CVE-2022-3141 Product : ACS EDU 3rd...

CVE-2020-3580

CVE-2020-3580 Cisco ASA / FTD reflected XSS in the WebVPN SAML SP ACS endpoint /+CSCOE+/saml/sp/acs. Patched in cisco-sa-asaftd-xss-multiple-FCB3vPZe. This repo contains: xss.html — a human-verifiable PoC for authorized targets. src/ — a discovery + scope-aware validation pipeline. docs/ —...

CVE-2026-122220

WPO365 | LOGIN wpo365-login plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2Service::checkmessageid, which never persists processed SAML message IDs to the wpo365samlmessageids transient due to a log...

CVE-2026-116201

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

EUVD-2026-109459

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

CVE-2026-116201

The software Snipe-IT versions before 8.5.0 is vulnerable to a SAML assertion replay vulnerability. The root cause is a non-atomic nonce check within the SAML acs handler , which creates a race condition . By sending concurrent POST requests to /saml/acs using a single captured assertion, an atta...

Grokability Snipe-IT authorization issue vulnerability

Versions of Grokability Snipe-IT prior to 8.5.0 contain an authorization issue vulnerability. This flaw stems from the non-atomic nature of nonce checks within the SAML acs handler, potentially enabling SAML assertion replay. Attackers can send concurrent POST requests to /saml/acs to reuse...

PT-2026-123042

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

Security Bulletin: IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

Summary IBM i Access Client Solutions ACS is affected by multiple vulnerabilities CVE-2026-94002, CVE-2026-94029 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-94002 DESCRIPTION: Possible memory exhaustion in SFTP clients DefaultSftpClient in component...

CVE-2026-103314

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and...

EUVD-2026-104252

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and...

CVE-2026-103314

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and...

CVE-2026-103314: Authentication Bypass by Capture-replay

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and...

Red Hat Advanced Cluster Security for Kubernetes Authorization Issue Vulnerability

Red Hat Advanced Cluster Security for Kubernetes version 4 has an authorization issue vulnerability. This vulnerability stems from the Central SAML authentication ACS endpoint not retaining the used SAML assertion or response identifier to prevent replay attacks. An attacker can submit multiple...

CVE-2026-14275 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command...

CVE-2026-14276 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action...