https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 19:27:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-16819 EUVD-2026-16819 https://cve.radiocsirt.org/vuln/euvd-2026-16819 https://cve.radiocsirt.org/vuln/fkie_cve-2022-31261 <p>An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.</p> <p>An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-31261 https://cve.radiocsirt.org/vuln/ghsa-95hq-2w8q-xw2v <p>An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.</p> <p>An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.</p> https://cve.radiocsirt.org/vuln/ghsa-95hq-2w8q-xw2v https://cve.radiocsirt.org/vuln/gsd-2022-31261 gsd-2022-31261 https://cve.radiocsirt.org/vuln/gsd-2022-31261