SUSE CVE-2026-86219

Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. serverstep...

CVE-2026-55250

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

EUVD-2026-74284

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

CVE-2026-55250 Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

CVE-2026-55250

Maravel Framework (a PHP dependency-injection framework), prior to version 10.74.0 , is affected by a Token Replay Vulnerability (CVSS 8.7 HIGH). The root cause is a lifecycle mismatch: tymon/jwt-auth writes 14-day JWT blacklist entries into tagged cache, but Maravel's O(1) Atomic Lazy Eviction m...

CVE-2026-55250 Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

CVE-2026-84003

Authentication bypass by capture-replay in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-84003

Authentication bypass by capture-replay in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-69676

Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network...

CVE-2026-84003

Microsoft Authentication Library (MSAL) for Node.js is affected by an authentication bypass via capture-replay that allows an unauthorized network attacker to perform spoofing . The underlying cause is the ability to capture and replay authentication tokens, leading to high confidentiality and in...

EUVD-2026-73922

Authentication bypass by capture-replay in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to perform spoofing over a network...

Insufficiently Protected Credentials

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the WORKLOADIDENTITY authenticator through AuthByWorkloadIdentity.prepare in src/snowflake/connector/auth/workloadidentity.py. An...

CVE-2026-69676

CVE-2026-69676 is an authentication bypass by capture-replay vulnerability in Windows Kerberos that allows an authorized attacker to achieve remote code execution over a network. The underlying mechanism involves replaying captured Kerberos authentication traffic, enabling privilege escalation be...

EUVD-2026-73071

Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network...

Exploit for CVE-2026-73316

CVE-2026-73316 XenForo before 2.3.13 processes the same valid...

Exploit for CVE-2026-73312

CVE-2026-73312 XenForo before 2.3.13 can leave an OAuth2 refr...

Exploit for CVE-2026-73311

CVE-2026-73311 XenForo before 2.3.13 allows an OAuth2 authori...

CVE-2026-86600

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

SUSE-SU-2026:23691-1 Security update for tomcat11

This update for tomcat11 fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...