CVE-2026-28155 WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

EUVD-2026-57949

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2026-28156

CVE-2026-28156 pertains to the WordPress Do Lasso plugin

CVE-2026-28156

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2026-28155

CVE-2026-28155 corresponds to an unauthenticated Insecure Direct Object References (IDOR) vulnerability in the WordPress Do Lasso plugin, affecting versions up to 358. The CVSS 3.1 base metrics indicate Network attack vector, Low attack complexity, No privileges required, with Confidentiality imp...

PT-2026-71517

Unauthenticated Cross Site Scripting XSS in Do Lasso = 358 versions...

PT-2026-71514

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

PT-2026-71515

Subscriber SQL Injection in Do Lasso = 358 versions...

PT-2026-71516

Subscriber Path Traversal in Do Lasso = 358 versions...

Photon OS 5.0: Lasso PHSA-2025-5.0-91-0674

An update of the lasso package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0674. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

The vulnerability of the lasso_node_impl_init_from_xml() function in the Lasso library allows a hacker to execute arbitrary code.

The vulnerability of the lassonodeimplinitfromxml function in the Lasso library is related to errors in data type mixing. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by sending specially crafted SAML packets...

The vulnerability of the g_assert_not_reached() function in the Lasso library, which allows a violator to trigger a service failure

The vulnerability of the gassertnotreached function in the Lasso library is related to an uncontrolled reachable assertion. Exploiting this vulnerability could allow a malicious actor, operating remotely, to trigger a service failure by sending specially crafted SAML packets...

CVE-2025-46705 affecting package lasso for versions less than 2.9.0-1

CVE-2025-46705 affecting package lasso for versions less than 2.9.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-46784 affecting package lasso for versions less than 2.9.0-1

CVE-2025-46784 affecting package lasso for versions less than 2.9.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-47151 affecting package lasso for versions less than 2.9.0-1

CVE-2025-47151 affecting package lasso for versions less than 2.9.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-46404 affecting package lasso for versions less than 2.9.0-1

CVE-2025-46404 affecting package lasso for versions less than 2.9.0-1. An upgraded version of the package is available that resolves this issue...

MiracleLinux 8 : lasso-2.6.0-12.el8 (AXSA:2021-2745:02)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2021-2745:02 advisory. lasso: XML signature wrapping vulnerability when parsing SAML responses CVE-2021-28091 Tenable has extracted the preceding description block directly from th...

MiracleLinux 7 : lasso-2.5.1-8.0.1.el7.AXS7 (AXSA:2021-2283:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2283:01 advisory. lasso: XML signature wrapping vulnerability when parsing SAML responses CVE-2021-28091 Tenable has extracted the preceding description block directly from th...

MiracleLinux 9 : lasso-2.7.0-11.el9.3 (AXSA:2025-11104:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-11104:02 advisory. lasso: Type confusion in Entr'ouvert Lasso CVE-2025-47151 Tenable has extracted the preceding description block directly from the MiracleLinux security...

Linux Distros Unpatched Vulnerability : CVE-2023-26487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.lassoAppend' function accepts 3...