2536 matches found
CVE-2026-91165: Improper Neutralization of Input During Web Page Generation
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the responsemode=formpost SSO return path in warpgate-protocol-http/src/api/ssoproviderlist.rs uses serdejson::tostring inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The...
PT-2026-96224
Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.27.6 Description The SSO return path using response mode=form post in the warpgate-protocol-http/src/api/sso provider list.rs file fails to neutralize script-closing sequences when using serde json::to string insid...
CVE-2026-58491: Improper Neutralization of Input During Web Page Generation
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...
PT-2026-96274
Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2 Description The GET '/api/login with code/:id' endpoint fails to apply the limiterLoginBruteForce mechanism when processing nine-digit SSO authentication codes. This allows an unauthenticated attacker to...
CVE-2026-46649: Improper Restriction of Excessive Authentication Attempts
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/loginwithcode/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An...
MAL-2026-16299 Malicious code in @pwaplatform/module-sso-integration (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f674867f67f5a8495dbc953913b6cc7c0d8b9d094161c660ca4dfd5449506ba @pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install...
Malicious code in @pwaplatform/module-sso-integration (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f674867f67f5a8495dbc953913b6cc7c0d8b9d094161c660ca4dfd5449506ba @pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install...
OpenAM v16.1.3
Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements, and Web Services Security. Cross Domain Single Sign On CDSSO, SAML 2.0, OAuth 2.0 & OpenID Connect ensure that OpenAM integrates easily with legacy, custom, a...
CVE-2026-75878
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...
CVE-2026-75878 IBM Sterling File Gateway is Vulnerable to Authentication Bypass
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...
CVE-2026-75878 IBM Sterling File Gateway is Vulnerable to Authentication Bypass
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...
CVE-2026-75878
IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1 allow a remote attacker to bypass authentication and obtain a fully authenticated session by sending an unvalidated SSO header (CWE-287: Improper Authentication). The vulnerability i...
EUVD-2026-83300
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...
authelia v4.39.28
!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...
How to Configure HTTP Proxy for Veeam Service Provider Console 9.3+
Purpose This article explains how to configure an HTTP proxy for Veeam Service Provider Console 9.3 and later, which introduced a dedicated proxy configuration mechanism that is disabled by default and does not use the WinHTTP, Internet Options, or environment variable proxy settings described in...
CVE-2026-75878: Improper Authentication
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...
PT-2026-95619
Name of the Vulnerable Software and Affected Versions IBM Sterling File Gateway affected versions not specified Description Improper authentication occurs due to an unvalidated SSO header, which allows a remote attacker to bypass authentication and obtain a fully authenticated session without...
CVE-2026-54510
Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrfexemptforapitokens beforerequest hook in src/app.py calls csrf.exemptviewfunc, permanently adding the selected view to Flask-WTF's process-global exemption set. The...
EUVD-2026-82427
Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrfexemptforapitokens beforerequest hook in src/app.py calls csrf.exemptviewfunc, permanently adding the selected view to Flask-WTF's process-global exemption set. The...
CVE-2026-54510
Speakr is a self-hosted web application for transcribing audio recordings. Prior to 0.8.21-alpha , the csrf_exempt_for_api_tokens() before_request hook in src/app.py calls csrf.exempt(view_func), permanently adding a view to Flask-WTF's process-global exemption set. The is_token_authenticated() f...