CVE-2026-1554 Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007

XML Injection aka Blind XPath Injection vulnerability in Drupal Central Authentication System CAS Server allows Privilege Escalation.This issue affects Central Authentication System CAS Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2...

CVE-2026-1554: XML Injection (aka Blind XPath Injection)

XML Injection aka Blind XPath Injection vulnerability in Drupal Central Authentication System CAS Server allows Privilege Escalation.This issue affects Central Authentication System CAS Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2...

org.apereo.cas:cas-server-core-api (>=5.3.7, <=5.3.16), org.apereo.cas:cas-server-core-api-authentication (>=5.3.7, <=5.3.16) +28 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.21.release)

org.springframework:spring-websocket MAVEN version 4.3.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.apereo.cas:cas-server-core-api =5.3.7, =5.3.7, =5.3.7, =5.3.7, =5.3.7,...

com.ahome-it:ahome-tooling-server-core (>=1.1.10-release, <=1.1.12-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.10-release, <=1.1.12-release) +110 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.2.release)

org.springframework:spring-websocket MAVEN version 4.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.10-release, =1.1.10-release,...

com.arcadeanalytics:arcadeanalytics (>=1.0.2, <=1.0.8), com.github.codefrogcc:allocation (>=1.0.0, <=1.1.4) +269 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.18.release)

org.springframework:spring-websocket MAVEN version 4.3.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.arcadeanalytics:arcadeanalytics =1.0.2, =1.0.0, =1.0.0, =5.3.1, =5.3.1,...

EUVD-2014-2334

Malware in sbrugna...

EUVD-2017-1388

Malware in sbrugna...

org.jasig.cas:cas-server-webapp (3.4-rc1), org.jasig.openregistry:openregistry-repository-jpa-impl (>=0.1-m3.1, <=0.1-m4) +3 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (4.0.1.ga)

org.hibernate:hibernate-validator MAVEN version 4.0.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - org.jasig.cas:cas-server-webapp 3.4-rc1 -...

CVE-2025-46826 insa-auth Open-Redirect on provided CAS server login endpoint

insa-auth is an authentication server for INSA Rouen. A minor issue allowed third-party websites to access the server's secondary authentication bridge, potentially revealing basic student information name and number. However, the issue posed minimal risk, was never exploited, and had limited...

Regular Expression Denial Of Service (ReDoS)

org.apereo.cas, cas-server-core-configuration-metadata-repository is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to improper processing of the "Name" argument without input validation, which allows remote attackers to trigger excessive backtracking and degra...

net.aequologica.neo:dagr-vebchar (0.5.2-alpha), net.aequologica.neo:dagr-web (0.5.2-alpha) +108 more potentially affected by CVE-2025-0716 via org.webjars.npm:angular (>=1.2.32, <=1.8.3)

org.webjars.npm:angular MAVEN version =1.2.32, =0.5.2, =0.5.2, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =0.4.0, =1.1.3 and more Source cves: CVE-2025-0716 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-9919775...

org.apereo.cas:cas-server-support-shell (5.2.0-rc2), org.apereo.cas:cas-server-webapp (>=5.2.0-rc2, <=5.2.6) +3 more potentially affected by CVE-2025-3986 via org.apereo.cas:cas-server-core-configuration-metadata-repository (>=5.2.0-rc2, <=5.2.6)

org.apereo.cas:cas-server-core-configuration-metadata-repository MAVEN version =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.6 Source cves: CVE-2025-3986 Source advisory: GHSA-MVWQ-HCRJ-F5X9...

org.apereo.cas:cas-server-webapp (6.0.0-rc4), org.apereo.cas:cas-server-webapp-jetty (6.0.0-rc4) +2 more potentially affected by CVE-2025-3986 via org.apereo.cas:cas-server-core-configuration-metadata-repository (6.0.0-rc4)

org.apereo.cas:cas-server-core-configuration-metadata-repository MAVEN version 6.0.0-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-configuration-metadata-repository and may be impacted: -...

org.apereo.cas:cas-server-support-shell (5.2.0-rc2), org.apereo.cas:cas-server-webapp (>=5.2.0-rc2, <=5.2.6) +3 more potentially affected by CVE-2025-3986 via org.apereo.cas:cas-server-core-configuration-metadata-repository (>=5.2.0-rc2, <=5.2.6)

org.apereo.cas:cas-server-core-configuration-metadata-repository MAVEN version =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.6 Source cves: CVE-2025-3986 Source advisory: OSV:GHSA-MVWQ-HCRJ-F5X9...

org.jasig.cas:cas-server-webapp (3.4-rc1), org.jasig.openregistry:openregistry-repository-jpa-impl (>=0.1-m3.1, <=0.1-m4) +3 more potentially affected by CVE-2023-1932 via org.hibernate:hibernate-validator (4.0.1.ga)

org.hibernate:hibernate-validator MAVEN version 4.0.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - org.jasig.cas:cas-server-webapp 3.4-rc1 -...

org.apereo.cas:cas-server-core (5.3.0-rc4), org.apereo.cas:cas-server-core-api-audit (5.3.0-rc4) +244 more potentially affected by CVE-2023-25581 via org.pac4j:pac4j-core (3.0.0-rc2)

org.pac4j:pac4j-core MAVEN version 3.0.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.apereo.cas:cas-server-core 5.3.0-rc4 - org.apereo.cas:cas-server-core-api-audit 5.3.0-rc4 -...

org.jasig.cas:cas-server-support-pac4j (>=4.1.0-rc1, <=4.1.10), org.pac4j:pac4j-cas (1.7.1) +7 more potentially affected by CVE-2023-25581 via org.pac4j:pac4j-core (1.7.1)

org.pac4j:pac4j-core MAVEN version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.jasig.cas:cas-server-support-pac4j =4.1.0-rc1, =4.1.10 - org.pac4j:pac4j-cas 1.7.1 - org.pac4j:pac4j-gae 1.7.1 -...

io.buji:buji-pac4j (2.2.0), org.apereo.cas:cas-management-webapp (>=5.0.6, <=5.0.10) +97 more potentially affected by CVE-2023-25581 via org.pac4j:pac4j-core (1.9.7)

org.pac4j:pac4j-core MAVEN version 1.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - io.buji:buji-pac4j 2.2.0 - org.apereo.cas:cas-management-webapp =5.0.6, =5.0.6, =5.0.6, =5.0.6, =5.0.6, =5.0.6, =5.0.6,...

io.buji:buji-pac4j (>=2.0.0, <=2.0.1), net.binggl:ninja-google-oauth-module (1.0.5) +97 more potentially affected by CVE-2023-25581 via org.pac4j:pac4j-core (1.9.1)

org.pac4j:pac4j-core MAVEN version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - io.buji:buji-pac4j =2.0.0, =5.0.0.m3, =5.0.0.m3, =5.0.0.m3, =5.0.0.m3, =5.0.0.m3, =5.0.0.m3, =5.0.0.m3, =5.0.0.m3,...

org.apache.camel.kafkaconnector:camel-infinispan-kafka-connector (0.10.1), org.apache.camel:camel-infinispan (3.10.0) +18 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-client-hotrod (12.1.2.final)

org.infinispan:infinispan-client-hotrod MAVEN version 12.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-client-hotrod and may be impacted: - org.apache.camel.kafkaconnector:camel-infinispan-kafka-connector 0.10.1 -...