CVE-2026-15013

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-15013 SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because MoSAMLUtilities::mosamlcastkey reads the SignatureMethod Algorithm attribute directl...

EUVD-2026-44842

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processin...

CVE-2026-48863 Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processin...

CVE-2026-48863

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processin...

CVE-2026-48863

The CVE-2026-48863 issue is a stack-based buffer overflow in libsolv’s EdDSA verification when copying the EdDSA 's' MPI, caused by length handling. An adversary could craft an Ed25519 PGP signature with mismatched MPI lengths to trigger a denial of service in automated package/repo processing wo...

CVE-2026-48863 Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processin...

PT-2026-60486

Name of the Vulnerable Software and Affected Versions Microsoft Office 365 Integration plugin versions prior to 4.5.6 Microsoft Office 365 Integration plugin versions prior to 5.0.5 Microsoft Office 365 Integration plugin versions prior to 5.1.1 Description The Microsoft Office 365 Integration...

Linux Distros Unpatched Vulnerability : CVE-2026-47304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-47304 Note that...

CVE-2026-46684

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilterdoFilter pass X-DE-TOKEN values to TokenUtils.validate, which checks only token presence and length before userBOByTokentoken uses JWT.decode without signature...

CVE-2026-59955

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under...

CVE-2026-59955 Apollo ConfigService access key authentication bypass via raw config file appId parsing

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under...

kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMADIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then...

CVE-2026-61436 PraisonAI before 4.6.78 Missing Webhook Signature Verification

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...

EUVD-2026-44642

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to PyJWT

Summary PyJWT is used by IBM Cloud Pak for Data System 1.0 as a Python library for encoding and decoding JSON Web Tokens JWT for authentication and authorization. Multiple vulnerabilities affect PyJWT. CVE-2026-48522 involves a Server-Side Request Forgery SSRF vulnerability where PyJWKClient pass...

[SECURITY] [DLA 4683-1] wolfssl security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-4683-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta July 15, 2026 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...

PT-2026-60341

Name of the Vulnerable Software and Affected Versions Autel MaxiCharger AC Elite Home affected versions not specified Description An issue exists in the handling of software updates due to the improper verification of cryptographic signatures. This allows a physically present attacker to execute...

Debian dla-4683 : libwolfssl-dev - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4683 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4683-1 [email protected]...

CVE-2026-45363

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decodetoken, '', true, algorithm: 'HS256' accepts an attacker-forged token because OpenSSL::HMAC.digest'SHA256', '', payload returns a valid digest under an empty key and no empty-key...