EEF-CVE-2026-91039 dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Summary Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each...

CVE-2026-54475

A Missing Authorization vulnerability (CWE-862) exists in Apache ActiveMQ (Broker, All, and standard versions). The issue stems from a failure to enforce isolation for Classic temporary destinations on the server side; while the client is expected to isolate these destinations to the connection t...

Haxx libcurl Memory Misreference Vulnerability

Haxx libcurl is a free, open source client-side URL transport library from the Swedish company Haxx. A memory misreference vulnerability exists in Haxx libcurl versions prior to 7.50.1. An attacker could exploit the vulnerability to take control of the connection being used...