https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:48:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-248637 EUVD-2026-248637 https://cve.radiocsirt.org/vuln/euvd-2026-248637 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54419 <p>A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. To conduct the attack an attacker would need a validly signed document from the identity provider (IdP). This is fixed in version 5.1.0.</p> <p>A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. To conduct the attack an attacker would need a validly signed document from the identity provider (IdP). This is fixed in version 5.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-54419 https://cve.radiocsirt.org/vuln/ghsa-4mxg-3p6v-xgq3 <p><strong>Affected:</strong> npm: @node-saml/node-saml, npm: passport-saml, npm: @node-saml/passport-saml</p> <p>Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature.</p> <p>This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username.</p> <p>To conduct the attack an attacker would need a validly signed document from the identity provider (IdP).</p> <p>In fixing this we made sure to process the SAML assertions from only verified/authenticated contents. This will prevent future variants from coming up.</p> <p>Note: this is distinct from the previous xml-crypto CVEs.</p> <p><strong>Affected:</strong> npm: @node-saml/node-saml, npm: passport-saml, npm: @node-saml/passport-saml</p> <p>Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature.</p> <p>This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username.</p> <p>To conduct the attack an attacker would need a validly signed document from the identity provider (IdP).</p> <p>In fixing this we made sure to process the SAML assertions from only verified/authenticated contents. This will prevent future variants from coming up.</p> <p>Note: this is distinct from the previous xml-crypto CVEs.</p> https://cve.radiocsirt.org/vuln/ghsa-4mxg-3p6v-xgq3 https://cve.radiocsirt.org/vuln/rhsa-2025:14090 <p>rhdh: Red Hat Developer Hub user permissions pbkdf2: pbkdf2 silently returns predictable key material multer: Multer Denial of Service golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net http-proxy-middleware: Always-Incorrect Control Flow Implementation in http-proxy-middleware http-proxy-middleware: Improper Check for Unusual or Exceptional Conditions in http-proxy-middleware tar-fs: tar-fs has issue where extract can write outside the specified dir with a specific tarball multer: Multer vulnerable to Denial of Service via unhandled exception @node-saml/node-saml: Node-SAML Signature Verification Vulnerability</p> <p>rhdh: Red Hat Developer Hub user permissions pbkdf2: pbkdf2 silently returns predictable key material multer: Multer Denial of Service golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net http-proxy-middleware: Always-Incorrect Control Flow Implementation in http-proxy-middleware http-proxy-middleware: Improper Check for Unusual or Exceptional Conditions in http-proxy-middleware tar-fs: tar-fs has issue where extract can write outside the specified dir with a specific tarball multer: Multer vulnerable to Denial of Service via unhandled exception @node-saml/node-saml: Node-SAML Signature Verification Vulnerability</p> https://cve.radiocsirt.org/vuln/rhsa-2025:14090 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2664 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HCL BigFix ausnutzen, um Daten zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HCL BigFix ausnutzen, um Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2664