CVE-2026-15981

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mosamlvalidatesignature function performing a loose boolean check on the raw tri-state integer returned by PHP's opensslverify, causing a...

CVE-2026-15981

The CVE describes an unauthenticated authentication bypass in the WordPress SAML SSO Login plugin up to version 5.4.4. The root cause is mo_saml_validate_signature() evaluating the OpenSSL verify result (-1) as truthy due to a loose boolean check on the value returned by PHP openssl_verify(). Thi...

EUVD-2026-48428

The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a Read Request...

GHSA-R7WM-3CXJ-WFF9 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, flyway, gradle, wildfly, apicurio-registry, infinispan...

CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

CVE-2026-47723

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

CVE-2026-47723

Nebula-mesh is affected by missing security headers in internal/web/ and internal/api/ paths prior to v0.3.1 (up to v0.3.0). The root cause is absence of standard headers such as CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Strict-Transport-Security in responses, enabling cl...

CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

React Router: Open redirect leading to XSS

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors...

MINI-GCF7-GG34-256G

Bulletin has no description...

MINI-J2JX-66J5-MX4M

Bulletin has no description...

MINI-QV6V-PXGV-F7P6

Bulletin has no description...

MINI-9GF3-V9QC-HF9M

Bulletin has no description...

MINI-RC6F-8VG2-9J97

Bulletin has no description...

MINI-3HMX-5VFH-G6CW

Bulletin has no description...

MINI-H5MR-WJRG-4R6Q

Bulletin has no description...

MINI-2HRX-JHX3-QRH3

Bulletin has no description...

MINI-F2R8-6QQV-MV8R

Bulletin has no description...

CVE-2026-15687

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false...