8866 matches found
CVE-2026-86756
Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key after stripping only CR/LF characters, and LoginCon...
Linux Distros Unpatched Vulnerability : CVE-2026-82059
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal...
Security Advisory 0172
Security Advisory 0172 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73438 CVSSv3.1 Base Score: 5.3...
Linux Distros Unpatched Vulnerability : CVE-2026-82068
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted...
Linux Distros Unpatched Vulnerability : CVE-2026-82064
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server...
SUSE CVE-2026-84947
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...
CVE-2026-78631
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78629
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
CVE-2026-78623
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...
CVE-2026-78579
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of th...
CVE-2026-78631 Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78631
Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This improper restriction of sensitive information makes a live authentication credential readable by any local user with access to that log ...
EUVD-2026-74183
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78631 Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
EUVD-2026-74181
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
CVE-2026-78629
The Okta Hyperdrive agent plugin contains an improper authentication verification flaw in its MFA response handling. When an organization's policy does not require MFA for a given user, the plugin returns a success response that contains only a bare boolean validation indicator rather than a sign...
CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
EUVD-2026-74177
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of th...
CVE-2026-78579
CVE-2026-78579 affects the Okta Access Gateway , specifically its LDAP datastore configuration . The root cause is that SAML assertion attribute values are not sanitized before being interpolated into LDAP search filters, allowing an attacker with low privileges to modify the intended query logic...