5929 matches found
Exploit for CVE-2026-15964
CVE-2026-15964 - Single Sign On For TNG "success":true...
SUSE CVE-2026-45570
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containin...
CVE-2026-67328
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...
CVE-2026-67328 @better-auth/sso before 1.6.21 Account Takeover via SSO
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...
CVE-2026-67328 @better-auth/sso before 1.6.21 Account Takeover via SSO
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...
CVE-2026-67328
Summary: CVE-2026-67328 affects @better-auth/sso versions before 1.6.21, which contain multiple authentication bypass vulnerabilities in the SSO provider handling. This can allow attackers to sign in as arbitrary users, enabling unauthorized session access and account takeover. Exploitation vecto...
CVE-2026-15964 Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the ssoprocessajax function — registered on wpajaxnoprivssoprocessajax and therefore reachable without authenticati...
EUVD-2026-51789
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the ssoprocessajax function — registered on wpajaxnoprivssoprocessajax and therefore reachable without authenticati...
CVE-2026-15964
The WordPress plugin Single Sign On For TNG (WordPress) is affected up to version 2.0.0 by an authentication bypass via unauthenticated password reset. The root cause is the ssoprocess_ajax() handler (wp_ajax_nopriv_ssoprocess_ajax) accepting an attacker-supplied email with setnewpassword and cal...
PT-2026-67308
Name of the Vulnerable Software and Affected Versions @better-auth/sso versions prior to 1.6.21 Description Multiple authentication bypass issues exist in the handling of SSO providers, allowing attackers to sign in as arbitrary users. This can be achieved through domain verification parsing...
CVE-2026-15964: Unverified Password Change
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the ssoprocessajax function — registered on wpajaxnoprivssoprocessajax and therefore reachable without authenticati...
PT-2026-67087
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the ssoprocess ajax function — registered on wp ajax nopriv ssoprocess ajax and therefore reachable without...
DEBIAN-CVE-2026-62959
Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...
CVE-2026-17566
pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...
CVE-2026-17566 pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...
CVE-2026-17566 pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...
CVE-2026-17566 pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...
CVE-2026-17566
Summary of CVE-2026-17566 (pgAdmin 4): The Import/Export Data tool builds a psql \copy (...) command by interpolating a user-supplied SQL query into a Jinja template and passing it via --command. A flawed parenthesis-balance check in create_import_export_job() treated a backslash-quote (') as esc...
EUVD-2026-51565
pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...