CVE-2026-16299

The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign extension of kfunc call arguments kfunc calls are native calls, so they should follow LoongArch calling conventions. Sign extension of arguments should be performed properly to avoid kernel panic. This is...

CVE-2026-16299

The CVE concerns the Single Sign On For TNG WordPress plugin prior to version 2.2.0. The root cause is improper validation of password reset requests, enabling unauthenticated attackers to reset passwords for arbitrary users (including administrators). This can lead to a full site takeover as des...

EUVD-2026-55035

The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

Linux Distros Unpatched Vulnerability : CVE-2026-68295

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operations write a 32-bit result and leave the upper 32 bits of the BPF register zero. The...

[SECURITY] Fedora 43 Update: freeipa-4.13.2-1.fc43

IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...

CVE-2026-64665

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2024-10302

The CVE affects the user self-signup flow in multiple WSO2 products, where inadequate validation lets unvalidated input enter user claims. This can lead to downstream processing of malicious or malformed data, with potential content manipulation, redirection, UI inconsistencies, unauthorized acti...

EUVD-2024-55708

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various...

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-7557

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affec...

CVE-2026-16442

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

CVE-2026-7557 SAML authentication bypass in Progress MarkLogic Server

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affec...

NPM: Electron: Parent process code-sign check is spoofable

NPM: Electron: Parent process code-sign check is spoofable vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

GHSA-JM7P-CC5G-QWXX Electron: Parent process code-sign check is spoofable

Impact On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRONRUNASNODE and NODEOPTIONS to same-signed parents rely on this check; a local attacker could bypas...

CVE-2026-70597 Electron: Parent process code-sign check is spoofable

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

EUVD-2026-53395

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

Malicious code in sso-tramvai-lib-roles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e65dc1bddf00bff70eb22b92e6ef1ad03aca2e1ab5f4c02b93d248d307f149 The package advertises itself as an SSO roles library but on require loads runtime.js, which detects the host platform, downloads an unsigned binary...