139 matches found
coinsta (>=0.1.5, <=0.1.6), cricket-rankings (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-41066 via lxml (4.2.2)
lxml PYPI version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - coinsta =0.1.5, =1.0.1, =1.0.3 - onelogin 1.4.0 Source cves: CVE-2026-41066 Source advisory: OSV:PYSEC-2026-87...
bluesnap (>=1.2018.7.26, <=1.2021.4.26), onelogin (>=1.4.1, <=1.6.1) +8 more potentially affected by CVE-2026-41066 via lxml (4.2.3)
lxml PYPI version 4.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bluesnap =1.2018.7.26, =1.4.1, =1.4.0, =0.10.3, =1.2.0, =1.0.0, =1.0.5, =0.3.1, =0.5.1 Source cves: CVE-2026-41066 Source advisory: OSV:GHSA-VFMQ-68HX-4...
coinsta (>=0.1.5, <=0.1.6), cricket-rankings (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-41066 via lxml (4.2.2)
lxml PYPI version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - coinsta =0.1.5, =1.0.1, =1.0.3 - onelogin 1.4.0 Source cves: CVE-2026-41066 Source advisory: OSV:GHSA-VFMQ-68HX-4JFW...
OneLogin JWT Signing Key Handler Unauthorized Access
The vulnerability of the JWT Signing Key Handler component in the OneLogin AD Connector software allows unauthorized access to protected information in the error-prone data area. Exploiting this vulnerability can enable a malicious actor to gain unauthorized access to sensitive data...
OneLogin ruby-saml data forge vulnerability
Onelogin OneLogin ruby-saml is a Ruby-based SAML Security Assertion Markup Language library for Single Sign-On SSO services from Onelogin, USA. A data forgery issue vulnerability exists in OneLogin ruby-saml version 1.12.4 and earlier, which stems from XML parsing differences and could lead to...
EUVD-2019-0118
Malware in sbrugna...
EUVD-2019-0609
Malware in sbrugna...
EUVD-2016-1922
Malware in sbrugna...
EUVD-2025-21947
Malicious code in bioql PyPI...
EUVD-2025-29110
Malicious code in bioql PyPI...
EUVD-2025-19634
Malicious code in bioql PyPI...
EUVD-2025-19636
Malicious code in bioql PyPI...
EUVD-2025-19689
Malicious code in bioql PyPI...
EUVD-2025-19635
Malicious code in bioql PyPI...
OneLogin Bug Let Attackers Use API Keys to Steal OIDC Secrets and Impersonate Apps
A high-severity security flaw has been disclosed in the One Identity OneLogin Identity and Access Management IAM solution that, if successfully exploited, could expose sensitive OpenID Connect OIDC application client secrets under certain circumstances. The vulnerability, tracked as CVE-2025-5936...
CVE-2025-59363
In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...
CVE-2025-59363: Incorrect Resource Transfer Between Spheres
In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...
CVE-2025-59363
In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...
CVE-2025-59363
In One Identity OneLogin prior to 2025.3.0, the GET /api/2/apps endpoint returned OIDC client_secret values alongside app metadata, enabling disclosure of sensitive credentials. This is caused by excessive data being returned by the Apps API v2 and constitutes a breach of confidentiality for OIDC...
CVE-2025-59363
In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...