CVE-2026-54733 moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin localo365 Teams SSO endpoint ssologin.php base64-decodes a JWT payload and authenticates...

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages relates to the execution of operations outside of the buffer boundaries, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of Microsoft Word text editors, Microsoft Office software packages, and Microsoft 365 Apps for Enterprise, related to the use of memory after it is freed, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Word, the Microsoft Office suite, and Microsoft 365 Apps for Enterprise is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code by sending a specially created malicious file...

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages lies in insufficient validation of input data, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

The vulnerability of Microsoft Visio graphic editors, Microsoft Office programs, and 365 Apps for Enterprise, which stems from insufficient validation of input data, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Visio graphical editors, Microsoft Office programs, and 365 Apps for Enterprise is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code by opening a specially created file...

Vulnerability of the Microsoft Outlook client, Microsoft Office packages and Office 365, as well as the Microsoft Word text editor, related to the ability to bypass security features, allowing attackers to circumvent existing security restrictions.

The vulnerability of the Microsoft Outlook email client, Microsoft Office packages and Office 365, as well as the Microsoft Word text editor, is related to the bypassing of security features. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions...

The vulnerability of Microsoft Word, Microsoft Office products, and Office 365 allows a perpetrator to execute arbitrary code.

The vulnerabilities of Microsoft Office packages, Office 365, and the Microsoft Word text editor are related to errors in memory object handling. Exploiting these vulnerabilities can allow a malicious actor to execute arbitrary code remotely, using a specially crafted web page or file...

Nucleus CMS Cross-Site Scripting Vulnerability

Nucleus CMS is an open source PHP-based blog management software package developed by the Nucleus team. A cross-site scripting vulnerability exists in Nucleus CMS version 3.65. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of the 'title'...