SUSE CVE-2026-89914

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decoderangetlbi helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not...

CVE-2026-93127 bpf: Drop scalar id on sign-extending narrowing stack fills

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

EUVD-2026-81788

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

CVE-2026-90195 riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

CVE-2026-90195

This Linux kernel vulnerability affects the RISC-V (RV64) BPF JIT compiler . The RV64 ABI requires sign-extension for signed 1-byte and 2-byte kfunc arguments , but the JIT failed to perform this extension. The bug was previously masked by a state-pruning behavior in commit 7ce090afbf72, which in...

CVE-2026-90195 riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

WordPress Single Sign On For TNG plugin < 2.2.0 - Unauthenticated Arbitrary Password Reset vulnerability

Unauthenticated Arbitrary Password Reset vulnerability discovered by moonge in WordPress Plugin Single Sign On For TNG versions 2.2.0...

Exploring the new AWS Sign Up experience

This post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox...

CVE-2026-81632

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...

CVE-2026-80218

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...

CVE-2026-62108

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

EUVD-2026-81491

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-62108

CVE-2026-62108 is an unauthenticated Broken Authentication vulnerability in the Headless Single Sign On WordPress plugin, affecting versions 1.7.0 and earlier . Discovered by Joost Grunwald and scored 9.8 (CRITICAL) via CVSS 3.1 (network vector, no privileges or user interaction required, high im...

CVE-2026-62108 WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-62108 WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...

EUVD-2026-81485

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...

CVE-2026-81632

AshAuthenticationPhoenix (team-alembic), an Elixir authentication library for Phoenix, places a single-use sign-in token as a query parameter in a GET redirect after successful password authentication. The token travels in the request line, where it is retained by access logs, reverse proxies, an...

CVE-2026-80218

AshAuthentication (by team-alembic ) is vulnerable to Improper Authentication : a sign-in token issued for one resource can be accepted by another. The root cause is that extract_primary_keys_from_subject/2 parses the JWT sub claim with URI.parse/1 and retains only the query string, discarding th...

EUVD-2026-81484

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...