CVE-2026-109799 Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip))

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability CWE-347 in IASContextProvider, the runtime-context provider registered by default via bootstrapapp.IASContextProvider extracted the apptid, sapgtid and useruuid claims from the IAS JWT in the...

CVE-2026-123801

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a...

EUVD-2026-120152

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a...

CVE-2026-123801

The SuperTokens Core authentication server is vulnerable to a SAML replay attack in versions 11.3.0 through 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1. The root cause is that SAML.handleCallback fails to consume RelayState , record assertion identifiers, or enforce Response.InResponseTo ...

PT-2026-140956

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a...

CVE-2024-0044

CVE-2024-0044- CVE-2024-0044: a "run-as any app" high-severity vulnerability affecting Android versions 12 and 13 CVE-2024-0044 Exploit Script This Bash script demonstrates how to exploit CVE-2024-0044. For educational and testing purposes only. Prerequisites ADB Android Debug Bridge installed an...

cve-2025-24054-lab

CVE-2025-24054 — Detection & Mitigation Lab Project log for a defensive security lab on CVE-2025-24054 , the Windows New Technology LAN Manager NTLM Hash Disclosure Spoofing vulnerability, under the assumption that the affected system cannot be patched short-term. Blue-team educational project...

CVE-2026-100252

Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...

CVE-2026-100252

Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...

PT-2026-136922

Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...

CVE-2026-109142

The Krill server is vulnerable to an authorization bypass when a Certificate Authority (CA) and its parent reside on the same server. Instead of verifying a signed CMS message, the system executes the RFC 6492 provisioning exchange in-process and trusts the child_handle provided by the caller in ...

CVE-2026-109142 Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-109142 Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-55040

Microsoft SharePoint JWT Authentication Bypass CVE-2026-55040 Overview CVE-2026-55040.py is a proof-of-concept script to leverage the SharePoint authentication bypass vulnerability, CVE-2026-55040. For a full technical analysis, see our Rapid7 Analysis. Usage $ python CVE-2026-55040.py --help...

openSUSE 16: bouncycastle / bouncycastle-javadoc / bouncycastle-jmail / etc (openSUSE-SU-2026:22169-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22169-1 advisory. Update to 1.86: - CVE-2026-17507: negative signed leafindex values from unsigned wire encodings can cause heap exhaustion bsc1284075. -...

CVE-2026-115962

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

CVE-2026-115962 WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

CVE-2026-115962

The myCred WordPress plugin (versions through 4.0.1 ) is vulnerable to an Authentication Bypass by Spoofing vulnerability. This flaw allows for Identity Spoofing , where an attacker may bypass authentication mechanisms. While the vulnerability is identified as CWE-290 , the provided documents do ...

EUVD-2026-112736

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

CVE-2026-115962 WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...