CVE-2025-54419

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...

CVE-2025-54419 Node-SAML Contains SAML Signature Verification Vulnerability

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...

CVE-2025-54419 Node-SAML Contains SAML Signature Verification Vulnerability

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...

keycloak: Phishing attack via email verification step in first login flow

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

Blitz Identity Provider Auth Bypass

The vulnerability of the Blitz Identity Provider software is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to register a mail account that they do not have access to and then verify it...

CVE-2025-53942

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to...

GHSA-M837-G268-MMV7 Node-SAML SAML Authentication Bypass

Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any...

Node-SAML SAML Authentication Bypass

Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any...

PT-2025-30730

Name of the Vulnerable Software and Affected Versions Node-SAML affected versions not specified Description Node-SAML is susceptible to a flaw where it loads the assertion from the unsigned original response document, differing from the signature verification process. This allows modification of...

CVE-2025-53942

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to...

Work Provider Administration Data Access

The vulnerability of the Work Provider Administration component of the application for accessing, organizing, and interacting with various types of work in the Oracle Universal Work Queue system, a business automation solution from Oracle E-Business Suite, is related to deficiencies in access...

MAL-2025-6149 Malicious code in api-key-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a88a62f8ea00d632d4e82aaad35c4ba5fc30f8c8974e967235a721edb9df9c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in api-key-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a88a62f8ea00d632d4e82aaad35c4ba5fc30f8c8974e967235a721edb9df9c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in api-key-provider

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override

CVSS Rating High 7.5: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root acces...

Malicious code in @toptal/picasso-provider (npm)

The package communicates with a domain associated with malicious activity...

Keycloak < 26.3.0 Phishing Vulnerability

The version of Keycloak installed on the remote host is prior to 26.3.0. It is, therefore, affected by a phishing vulnerability. A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacke...

org.dspace:dspace-discovery-provider (1.7.0-rc1), org.dspace:dspace-discovery-xmlui-api (1.7.0-rc1) +13 more potentially affected by CVE-2025-53621 via org.dspace:dspace-api (1.7.0-rc1)

org.dspace:dspace-api MAVEN version 1.7.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-discovery-provider 1.7.0-rc1 - org.dspace:dspace-discovery-xmlui-api 1.7.0-rc1 -...

Improper Privilege Management vulnerability in Apache Kafka Client

Apache Kafka Clients are vulnerable to improper privilege management due to the use of ConfigProvider plugins that can read from disk or environment variables. This could allow an attacker to read arbitrary contents of the disk and environment variables, potentially escalating from REST API acces...

CVE-2025-50105: Improper Access Control

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Administration. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...