SUSE-SU-2026:22854-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue - CVE-2025-9943: SQL injection in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394...

GHSA-H9FM-XCV2-QFW3 Duplicate Advisory: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-33q9-f52j-gc75. This link is maintained to preserve external references. Original Description n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoin...

GHSA-JQH4-M9W3-8HP9

creationtimestamp| type| source ---|---|--- 2026-07-22 12:00:59+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmbavjt25 2026-08-12 12:01:33+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msv3gmhtf62e...

MINI-7R75-J3MC-249J

Bulletin has no description...

CVE-2026-47010

A flaw was found in OpenJDK. ASAN reports a heap integrity violation...

security-research

Security Research OAuth / OIDC and auth-logic vulnerability...

BELL-CVE-2026-63959

Bulletin has no description...

CVE-2026-16392

creationtimestamp| type| source ---|---|--- 2026-07-22 04:47:16+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722...

CVE-2026-16351

creationtimestamp| type| source ---|---|--- 2026-07-22 04:45:40+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-22 16:26:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mraqgdbx2i22 2026-07-24 00:01:17+00:00| see...

CVE-2026-63262

creationtimestamp| type| source ---|---|--- 2026-07-22 03:04:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr7dms6imx23...

GHSA-8V84-F9PQ-WR9X vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, openstack-horizon-2025.2-fips, openstack-horizon-2025.2, mlflow, label-studio, openstack-horizon-2026.1, superset, open-webui, superset-fips, tritonserver-backend-vllm-cuda-13.0, tensorflow-gpu-jupyter, openstack-horizon-2026.1-fips,...

CVE-2026-62546

creationtimestamp| type| source ---|---|--- 2026-07-22 01:43:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr773trwh72i 2026-07-22 16:42:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrarcxmbpu23 2026-07-23 18:20:51+00:00| seen|...

CVE-2026-62516

creationtimestamp| type| source ---|---|--- 2026-07-22 01:33:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr76kv4tsj2g 2026-07-23 18:20:38+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-56819

creationtimestamp| type| source ---|---|--- 2026-07-22 01:00:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr74onri4f2m 2026-07-22 02:42:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr7cf3wyvf23 2026-07-27 16:00:06+00:00| seen|...

EUVD-2026-47563

Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...

CVE-2026-65014: Missing Authentication for Critical Function

n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The...

CVE-2026-13089: Improper Verification of Cryptographic Signature

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self-alg$self-header-alg from the token's own header and then calls...

PT-2026-63495

Name of the Vulnerable Software and Affected Versions OIDC::Lite versions through 0.12.1 Description An issue exists where ID Token signature verification can be bypassed due to a token-controlled algorithm allowlist in the verify function. When a caller does not specify a pinned algorithm, the...

CVE-2026-22049: Authentication Bypass Using an Alternate Path or Channel

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication MFA configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA...

PT-2026-63447

Name of the Vulnerable Software and Affected Versions ONTAP versions 9.16.1 and higher Description An issue exists in the WebAuthn multi-factor authentication MFA configuration related to the Relying Party ID. An attacker possessing valid credentials could exploit this to bypass the MFA process...