CVE-2026-6691 MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow

The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI...

com.danhaywood.mavendeps:isiswebapp (0.0.2), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=2.0.0, <=2.1.10) +95 more potentially affected by CVE-2026-40010 via org.apache.wicket:wicket-auth-roles (>=8.0.0-m1, <=8.17.0)

org.apache.wicket:wicket-auth-roles MAVEN version =8.0.0-m1, =2.0.0, =2.0.0, =2.0.0, =3.2.0, =2.4.1, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =2.1.8.0, =2.1.8.0, =2.1.8.0, =2.1.8.0, =2.1.8.0, =2.1.14.0 and more Source cves: CVE-2026-40010https://vulners.com/cve/CVE-2026-40010...

com.danhaywood.mavendeps:isiswebapp (0.0.2), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=2.0.0, <=2.1.10) +95 more potentially affected by CVE-2026-40010 via org.apache.wicket:wicket-auth-roles (>=8.0.0-m1, <=8.17.0)

org.apache.wicket:wicket-auth-roles MAVEN version =8.0.0-m1, =2.0.0, =2.0.0, =2.0.0, =3.2.0, =2.4.1, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =2.1.8.0, =2.1.8.0, =2.1.8.0, =2.1.8.0, =2.1.8.0, =2.1.14.0 and more Source cves: CVE-2026-40010https://vulners.com/cve/CVE-2026-40010...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=3.0.1-rc, <=3.1.7) +55 more potentially affected by CVE-2026-40010 via org.apache.wicket:wicket-auth-roles (>=9.0.0-m1, <=9.22.0)

org.apache.wicket:wicket-auth-roles MAVEN version =9.0.0-m1, =1.3.1.release, =3.0.1-rc, =3.0.1-rc, =2.0.0-rc1, =2.0.0-rc1, =2.0.0-rc1, =2.0.0-rc1, =2.0.0-rc1, =2.0.0-rc1, =2.1.0 and more Source cves: CVE-2026-40010 Source advis...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=3.0.1-rc, <=3.1.7) +55 more potentially affected by CVE-2026-40010 via org.apache.wicket:wicket-auth-roles (>=9.0.0-m1, <=9.22.0)

org.apache.wicket:wicket-auth-roles MAVEN version =9.0.0-m1, =1.3.1.release, =3.0.1-rc, =3.0.1-rc, =2.0.0-rc1, =2.0.0-rc1, =2.0.0-rc1, =2.0.0-rc1, =2.0.0-rc1, =2.0.0-rc1, =2.1.0 and more Source cves: CVE-2026-40010 Source advis...

be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=4.0.0-m1, <=5.0.0) +33 more potentially affected by CVE-2026-40010 via org.apache.wicket:wicket-auth-roles (>=10.0.0-m1, <=10.8.0)

org.apache.wicket:wicket-auth-roles MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =4.0.0-m1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.0.0-m2 - org.apache.causeway.vie...

be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=4.0.0-m1, <=5.0.0) +33 more potentially affected by CVE-2026-40010 via org.apache.wicket:wicket-auth-roles (>=10.0.0-m1, <=10.8.0)

org.apache.wicket:wicket-auth-roles MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =4.0.0-m1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.0.0-m2 - org.apache.causeway.vie...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.5.8.release), com.danhaywood.mavendeps:isiswebapp (0.0.2) +132 more potentially affected by CVE-2026-40010 via org.apache.wicket:wicket-auth-roles (>=8.0.0-m1, <=10.8.0)

org.apache.wicket:wicket-auth-roles MAVEN version =8.0.0-m1, =1.3.1.release, =2.0.0, =2.0.0, =2.0.0, =3.2.0, =2.4.1, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =2.1.8.0, =2.1.8.0, =2.1.8.0, =2.1.14.0 and more Source cves: CVE-2026-40010 Source advisory: SNYK:JAVA-ORGAPACHEWICKET-16642421htt...

be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=4.0.0-m1, <=5.0.0) +33 more potentially affected by CVE-2026-40010 via org.apache.wicket:wicket-auth-roles (>=10.0.0-m1, <=10.8.0)

org.apache.wicket:wicket-auth-roles MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =4.0.0-m1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.0.0-m2 - org.apache.causeway.vie...

CVE-2026-43585: Operation on a Resource after Expiration or Release

OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket handlers fail to re-resolve authentication per-request, enabling attackers to use rotated-out bearer tokens for unauthoriz...

PT-2026-41486

Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-tenant isolation, access-control, and policy-enforcement defects in the AxonFlow platform. They are filed as a single consolidated advisory because the recommended remediation is a...

PT-2026-41501

Summary The unauthenticated resend-verification endpoint returns different responses for registered and unregistered email addresses. A malicious third party can submit candidate addresses to /api/v4/account/auth/resend verification email and distinguish accounts from misses. Details resend...

python311-social-auth-core-4.8.7-1.1 on GA media (moderate)

python311-social-auth-core-4.8.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:10681-1 Rating: moderate Cross-References: CVE-2026-32597 CVSS scores: CVE-2026-32597 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2026-32597 SUSE : 8.7...

CVE-2026-7713

A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generateauthtoken of the file cps/koboauth.py of the component Kobo auth-token Route. The manipulation results in improper authorization. The attack may be performed fr...

S3-Proxy has Security Issues in its Resource Path Matching Implementation

Background The original concern is functional: a resource pattern should treat a percent-encoded segment like some%2Fvalue as a single opaque token rather than splitting it into two path segments at the decoded /. Investigation into why %2F was being decoded and how routes matched against the...

GHSA-RFGQ-WGG8-662P S3-Proxy has Security Issues in its Resource Path Matching Implementation

Background The original concern is functional: a resource pattern should treat a percent-encoded segment like some%2Fvalue as a single opaque token rather than splitting it into two path segments at the decoded /. Investigation into why %2F was being decoded and how routes matched against the...

@workos/authkit-session has an Open Redirect via state-derived redirect target

An open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider IdP and can be influenced by an attacker. The handleCallback...

GHSA-VVVV-983W-R7PV @workos/authkit-session has an Open Redirect via state-derived redirect target

An open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider IdP and can be influenced by an attacker. The handleCallback...

Malware in @enterprise-core/auth-gateway-bridge

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in internal-auth-provider

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...