sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation

A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...

Moderate: Red Hat Security Advisory: sssd security update

An update for sssd is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-13258

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended...

DEBIAN-CVE-2026-105829

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone script or iframe line followed by a block supplying...

CVE-2026-105829

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone script or iframe line followed by a block supplying...

UBUNTU-CVE-2026-105829

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone script or iframe line followed by a block supplying...

CVE-2026-105829

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone script or iframe line followed by a block supplying...

Security Bulletin: IBM DataPower Gateway affected by cross-site scripting (CVE-2026-14990)

Summary IBM DataPower Gateway affected by cross-site scripting CVE-2026-14990 Vulnerability Details CVEID:CVE-2026-14990 DESCRIPTION: IBM DataPower Gateway is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thu...

EUVD-2026-95016

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone script or iframe line followed by a block supplying...

CVE-2026-13258

IBM DataPower Gateway is vulnerable to a cross-site scripting (XSS) flaw (CWE-79) in its Web UI. This vulnerability allows an authenticated user to embed arbitrary JavaScript code, which can alter functionality and potentially lead to credentials disclosure within a trusted session. Affected vers...

CVE-2026-13258 IBM DataPower Gateway Cross-Site Scripting

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended...

EUVD-2026-95000

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended...

EUVD-2026-94986

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2026-14990

The IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 are vulnerable to a Cross-Site Scripting (XSS) vulnerability (CWE-79). This flaw allows an unauthenticated user to embed arbitrary JavaScript code into the Web UI, which can alter intended functionality and potentially lead to the disc...

CVE-2026-14990 IBM DataPower Gateway affected by cross-site scripting

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2026-62142

Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...

CVE-2026-106611

Cross-Site Request Forgery CSRF vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3...

EUVD-2026-94955

Cross-Site Request Forgery CSRF vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3...

CVE-2026-106611

The WPMU DEV Forminator plugin (versions n/a through 1.57.3 ) is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is associated with CWE-352 and has a High base sever...

WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin WP Store Locator versions = 3.0.3...