PT-2026-89251

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently prevent reuse of previously accepted SAML assertions. Under certain circumstances, a valid assertion may be...

SUSE CVE-2026-86219

Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. serverstep...

Exploit for CVE-2026-73311

CVE-2026-73311 XenForo before 2.3.13 allows an OAuth2 authori...

SUSE-SU-2026:23691-1 Security update for tomcat11

This update for tomcat11 fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

CVE-2026-86219

Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. serverstep...

CVE-2026-86219 Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. serverstep...

CVE-2026-86219 Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. serverstep...

CVE-2026-86219 Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. serverstep...

EUVD-2026-72163

Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. serverstep...

p5-Authen-SASL -- Replay attack in Authen::SASL::Perl::DIGEST_MD5

Authen-SASL project reports: Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the...

PT-2026-86564

Name of the Vulnerable Software and Affected Versions Authen::SASL::Perl::DIGEST MD5 versions prior to 2.2100 Description An issue exists where the software accepts replayed authentication responses due to an unverified nonce in the server step function. While server start generates a fresh nonce...

Linux Distros Unpatched Vulnerability : CVE-2026-86219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates...

CVE-2026-85528

Snowflake JDBC Driver versions 4.2.0 through 4.3.3 are affected by improper input validation of the auto-configuration account identifier, allowing a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint . An attacker who controls the account value can cause the...

Replay Attack

Spring Security is vulnerable to Replay Attack. The vulnerability is due to a strict size limit on the cache storing JWT ID claims, which allows an attacker to evict legitimate entries by flooding the server with dummy requests and subsequently replay intercepted valid DPoP proofs...

CVE-2026-79389: Improper Verification of Cryptographic Signature

Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the...

EUVD-2026-71742

Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the...

tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...

CVE-2026-53636

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...

EUVD-2026-70222

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...

CVE-2026-53636

The Open edX LMS platform has a replay vulnerability in its LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who capture...