The vulnerability of the Oracle WebLogic Server application server’s kernel allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Oracle WebLogic Server application server’s kernel is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information using the SAML protoc...

CVE-2026-15981

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mosamlvalidatesignature function performing a loose boolean check on the raw tri-state integer returned by PHP's opensslverify, causing a...

CVE-2026-15981

CVE-2026-15981 is a critical (CVSS 9.8) unauthenticated authentication bypass in the miniOrange SAML 2.0 Single Sign On – SSO Login WordPress plugin (≤ 5.4.4). The root cause is a loose boolean check in mo_saml_validate_signature(): PHP's openssl_verify() returns -1 on internal error, which evalu...

CVE-2026-15981 SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mosamlvalidatesignature function performing a loose boolean check on the raw tri-state integer returned by PHP's opensslverify, causing a...

CVE-2026-15614

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15615

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

CVE-2026-15614

The Logto identity and access management system is vulnerable to an authentication bypass via session replay because it fails to atomically handle IdP-initiated SAML sessions . The root cause is that session lookup and session deletion are separate steps; because the lookup response is returned b...

EUVD-2026-48303

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15615 SAML <Conditions> element not validated

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

CVE-2026-15615 SAML <Conditions> element not validated

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

EUVD-2026-48302

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

CVE-2026-15615

The Logto identity and access management platform is vulnerable to security flaws in its SAML implementation. Specifically, the system relies on the samlify library but fails to perform independent validation of the element. If an attacker omits the element from a forged or replayed assertion, ...

Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

...

Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments

...

CVE-2026-15615: Insufficient Verification of Data Authenticity

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

PT-2026-64019

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto fails to validate the SAML element. This allows attackers to remove time and audience restrictions, which enables the indefinite replay of assertions. SAML Security Assertion Markup...

CVE-2026-13073

The CVE describes an issue in MongoDB’s mongod where an authenticated user with read-only privileges can trigger abnormal termination via a crafted aggregation command. The root cause is an internal engine selection inconsistency caused by a specific combination of aggregation options, leading to...

CVE-2026-13073 MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency...

CVE-2026-13204

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

AZL-93117 CVE-2026-13204 affecting package bind for versions less than 9.20.26-1

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through...