CVE-2026-58073-check

Veeam Service Provider Console Agent Impersonation — Patch-State Detection Script A safe, unauthenticated detector for the KB4893 vulnerabilities in Veeam Service Provider Console published 2026-08-04. It answers one question per target, before any authentication or TLS: are the KB4893 fixes...

shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY --SamlValidity...

flask-saml2

flask-saml2 .. note:: Looking for maintainers. This project is unmaintained. The library works, or did when I last used it, but I no longer work on the project this was built for. If you are interested in taking over leadership and maintenance of this project, please get in touch. .. image::...

dnscrypt-autoinstall

dnscrypt-autoinstall This project has been archived, see last comment in 108. A script for installing and automatically configuring DNSCrypt on Linux-based systems. Description DNSCrypt is a protocol for securing communications between a client and a DNS resolver by encrypting DNS queries and...

CLEANSTART-2026-ZK87180 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2

Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...

PT-2026-108214

Name of the Vulnerable Software and Affected Versions NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37 NetScaler ADC 14.1-FIPS versions prior to 14.1-73.37 FIPS NetScaler ADC and NetScaler Gateway versions 14.1-73.37 through 14.1-73.41 NetScaler ADC 14.1-FIPS versions 14.1-73.37...

New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Citrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779 , carries a CVSS score of 8.7 out of 10.0. "CVE-2026-88779 is a memory overflow...

CLEANSTART-2026-SR72438 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2

Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...

Introducing the Wiz Partner Alliance Managed Service Provider Program

Empowering managed services partners to deliver world-class cloud and AI security at scale...

How to Configure HTTP Proxy for Veeam Service Provider Console 9.3+

Purpose This article explains how to configure an HTTP proxy for Veeam Service Provider Console 9.3 and later, which introduced a dedicated proxy configuration mechanism that is disabled by default and does not use the WinHTTP, Internet Options, or environment variable proxy settings described in...

ROOT-APP-MAVEN-CVE-2026-41003 CVE-2026-41003 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root

Root has patched CVE-2026-41003 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40993 CVE-2026-40993 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root

Root has patched CVE-2026-40993 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40988 CVE-2026-40988 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root

Root has patched CVE-2026-40988 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...

Astra Linux – Vulnerability in xmltooling

Shibboleth XMLTooling before version 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allowed SSRF through a specially crafted KeyInfo element. This issue has been fixed, for example, in Shibboleth Service Provider 3.4.1.3 on Windows...

CVE-2026-87950

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...

DRUPAL-CONTRIB-2026-149

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related...

DRUPAL-CONTRIB-2026-148

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...

DRUPAL-CONTRIB-2026-147

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity...

DRUPAL-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...