CVE-2026-44793

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...

CVE-2026-44793: Improper Neutralization of Input During Web Page Generation

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...

Astra Linux – Vulnerability in rabbitMQ-server

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI through the rabbitmqfederationmanagement plugin, its consumer tag was rendered without proper tag sanitization. This potentially allows for...

CVE-2026-90679

A flaw was found in Forgejo when federation is enabled. This issue allows a remote attacker to spoof identities by submitting signature-valid ActivityPub activities attributed to any actor identity. The system fails to verify that the HTTP Signature on an incoming ActivityPub activity was produce...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4 with [federation] ENABLED = true contains a signature-spoofing flaw in its ActivityPub inbox processing. The HTTP Signature verification in routers/api/v1/activitypub/reqsignature.go validates the request, but inbox handlers then read the acting identity from the att...

EUVD-2026-76944

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

PT-2026-90787

Name of the Vulnerable Software and Affected Versions Forgejo versions 13.0.0 through 16.0.4 Description An identity spoofing issue exists when federation ENABLED = true is configured. The system fails to verify that the HTTP Signature of an incoming ActivityPub activity was generated by the key...

CVE-2026-47839 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2026-47839

Cloud Foundry UAA and cf-deployment are vulnerable to a privilege-escalation flaw in federated OIDC authentication. When an OIDC identity provider is configured with groupMappingMode: AS_SCOPES and a wildcard externalGroupsWhitelist entry, users can obtain the uaa.admin scope despite operators in...

EUVD-2026-76026

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2026-73785

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

EUVD-2026-75977

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

CVE-2026-73785

HPE IceWall Federation Agent 4.0 and IceWall Federation Proxy 4.0 contain a denial-of-service vulnerability that can be triggered by a remote, unauthenticated attacker over the network with low complexity (CVSS 3.1: 7.5 HIGH ). Affected platforms include RHEL 7/8/9/10 and Windows. The impact is l...

CVE-2026-73785 HPE IceWall Federation Agent and Proxy, Denial of Service vulnerability

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

CVE-2026-73785: Improper Handling of Unexpected Data Type

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

PT-2026-89792

🚨 HIGH SEVERITY: CVE-2026-73785 CVSS 7.5 HPE IceWall Federation Agent & Proxy vulnerable to remote unauthenticated DoS attack. No user interaction required. Patch immediately. CVE Vulnerability PatchNow ThreatIntel https://t.co/7OEcwyYjWK...

PT-2026-89813

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS SCOPES with...

HPESBMU05142 rev.1 - HPE IceWall products, Remote Bypass of Security Restrictions

Potential Security Impact: Remote: Bypass Security Restrictions SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. IceWall MFA 4.0 Enterprise Edition - SAML Authentication Option RHEL7, RHEL8, RHEL9, RHEL10, Windows IceWall MFA 4.0 Standard Edition - SAML Authentication Option RHEL7,...