CVE-2024-50962

Cross-Site Scripting XSS in DonWeb Ferozo Webmail CVE-2024-50962 Description A Cross-Site Scripting XSS vulnerability in Ferozo Webmail v1.1 allows attackers to execute arbitrary scripts via the Identities and Automatic Responses components. This vulnerability can be used to hijack user sessions,...

AETHER-PROTOCOL-P

⬡ AETHER PROTOCOL — Aether AI LLC. 2026 Cryptographically Verified Short-Lived Identity Infrastructure for Autonomous AI Systems Patent Pending — US Application 64/006,746 — Filed March 16, 2026 "Every AI system in the world can be compromised by injecting false instructions into its pipeline...

severitas

🛡️ Severitas Framework Severitas is an authorized social-engineering awareness and simulation framework. It is structurally constrained to run exclusively inside isolated laboratory environments against synthetic identities. 💎 Features Severitas isolates assessment execution logically so that...

CVE-2026-123553

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to...

EUVD-2026-119438

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to...

CVE-2026-123553

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to...

PT-2026-139834

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to...

CVE-2026-123553: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService…

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to...

Important: Red Hat Security Advisory: zero trust workload identity manager for Red Hat OpenShift 1.1.3

zero trust workload identity manager for Red Hat OpenShift 1.1.3 The Zero Trust Workload Identity Manager ZTWIM is a day-2 operator. The operator manages lifecycle of operand components from SPIRE project. The goal of ZTWIM is to provide secure, verifiable workload identities for workloads in...

Important: Red Hat Security Advisory: zero trust workload identity manager for Red Hat OpenShift 1.1.3

zero trust workload identity manager for Red Hat OpenShift 1.1.3 The Zero Trust Workload Identity Manager ZTWIM is a day-2 operator. The operator manages lifecycle of operand components from SPIRE project. The goal of ZTWIM is to provide secure, verifiable workload identities for workloads in...

Important: Red Hat Security Advisory: zero trust workload identity manager for Red Hat OpenShift 1.1.3

zero trust workload identity manager for Red Hat OpenShift 1.1.3 The Zero Trust Workload Identity Manager ZTWIM is a day-2 operator. The operator manages lifecycle of operand components from SPIRE project. The goal of ZTWIM is to provide secure, verifiable workload identities for workloads in...

Important: Red Hat Security Advisory: zero trust workload identity manager for Red Hat OpenShift 1.1.3

zero trust workload identity manager for Red Hat OpenShift 1.1.3 The Zero Trust Workload Identity Manager ZTWIM is a day-2 operator. The operator manages lifecycle of operand components from SPIRE project. The goal of ZTWIM is to provide secure, verifiable workload identities for workloads in...

Important: Red Hat Security Advisory: zero trust workload identity manager for Red Hat OpenShift 1.1.3

zero trust workload identity manager for Red Hat OpenShift 1.1.3 The Zero Trust Workload Identity Manager ZTWIM is a day-2 operator. The operator manages lifecycle of operand components from SPIRE project. The goal of ZTWIM is to provide secure, verifiable workload identities for workloads in...

Important: Red Hat Security Advisory: zero trust workload identity manager for Red Hat OpenShift 1.1.3

zero trust workload identity manager for Red Hat OpenShift 1.1.3 The Zero Trust Workload Identity Manager ZTWIM is a day-2 operator. The operator manages lifecycle of operand components from SPIRE project. The goal of ZTWIM is to provide secure, verifiable workload identities for workloads in...

Important: Red Hat Security Advisory: zero trust workload identity manager for Red Hat OpenShift 1.1.3

zero trust workload identity manager for Red Hat OpenShift 1.1.3 The Zero Trust Workload Identity Manager ZTWIM is a day-2 operator. The operator manages lifecycle of operand components from SPIRE project. The goal of ZTWIM is to provide secure, verifiable workload identities for workloads in...

CLEANSTART-2026-RQ80380 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

CVE-2026-82053

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...

CLEANSTART-2026-NN31830 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

CLEANSTART-2026-RV97727 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the argo-cd package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

Traefik Labs Traefik authorization issue vulnerability

Traefik Labs Traefik versions prior to 3.7.0 and 3.7.14 contain an authorization issue vulnerability. This vulnerability arises because the Kubernetes Ingress-NGINX provider forwards client-supplied Ssl-Client- headers to plaintext HTTP routers. When ssl-redirect is disabled and...