Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31 results
Sep 10, 2026passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPCVE-2026-89043 · Other software · krakenjs · reported by VulnCheckCritical 9.1
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
- Product
- passport-saml-encrypted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by CVE-2026-89042 · Other software · krakenjs · reported by VulnCheckCritical 9.3
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
- Product
- passport-saml-encrypted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*) CVE-2026-86755 · Other software · grokability · reported by VulnCheckMedium 5.3
Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*) with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints (/account/api and /api/v1/account/personal-access-tokens). Any user with a valid web session and the corresponding CSRF token can POST to /oauth/personal-access-tokens and mint a long-lived bearer token for their own account, even when an administrator has denied the self.api permission. The issued token is still subject to existing per-endpoint authorization policies, so this is not a privilege escalation; it defeats the administrative control intended to block API/scripted access at the user's own permission level. Fixed in 8.7.0 (commit 3f74b8c), which registers overriding routes wrapped in the can:self.api middleware.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 9, 2026Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with aCVE-2026-86754 · Other software · grokability · reported by VulnCheckHigh 8.5
Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes for bearer tokens inheriting full admin API permissions lasting up to 40 years.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 7, 2026A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library.CVE-2026-44756 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 10
A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.
- Product
- SAP Extended Passport (EPP) Processing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attCVE-2026-16279 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comCritical 9.3
An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts.
- Product
- 3DSwymer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse.CVE-2026-15580 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bMedium 6.9
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.
- Product
- PassPortal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Laravel Passport provides OAuth2 server support to Laravel.CVE-2026-39976 · Other software · laravel · reported by GitHubHigh 7.1
Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.
- Product
- passport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol.CVE-2025-46573 · Other software · auth0 · reported by GitHubHigh 8.6
passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done by adding attributes to the response. Users are affected specifically when the service provider is using `passport-wsfed-saml2` and a valid SAML Response signed by the Identity Provider can be obtained. Version 4.6.4 contains a fix for the vulnerability.
- Product
- passport-wsfed-saml2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol.CVE-2025-46572 · Other software · auth0 · reported by GitHubCritical 9.3
passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid SAML object that was signed by the configured IdP. Users are affected specifically when the service provider is using passport-wsfed-saml2 and a valid SAML document signed by the Identity Provider can be obtained. Version 4.6.4 contains a fix for the vulnerability.
- Product
- passport-wsfed-saml2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCCVE-2024-6377 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.1
An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.
- Product
- 3DSwymer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote authenticated attacker with an administratiCVE-2023-51436 · Other software · Japan System Techniques Co., Ltd. · reported by vultures@jpcert.or.jpMedium 5.9
Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote authenticated attacker with an administrative privilege to execute an arbitrary script on the web browser of the user who is using the product.
- Product
- UNIVERSAL PASSPORT RX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrCVE-2023-42427 · Other software · Japan System Techniques Co., Ltd. · reported by vultures@jpcert.or.jpMedium 6.5
Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.
- Product
- UNIVERSAL PASSPORT RX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file.CVE-2023-47131 · Other software · n-able · reported by MITREHigh 7.5
The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file.
- Product
- passportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.n-able.comme.n-able.com
Apr 21, 2023@fastify/passport is a port of passport authentication library for the Fastify ecosystem.CVE-2023-29020 · Other software · fastify · reported by GitHubMedium 6.5
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affected versions, can be bypassed by network and same-site attackers. `fastify/csrf-protection` implements the synchronizer token pattern (using plugins `@fastify/session` and `@fastify/secure-session`) by storing a random value used for CSRF token generation in the `_csrf` attribute of a user's session. The `@fastify/passport` library does not clear the session object upon authentication, preserving the `_csrf` attribute between pre-login and authenticated sessions. Consequently, CSRF tokens generated before authentication are still valid. Network and same-site attackers can thus obtain a CSRF token for their pre-session, fixate that pre-session in the victim's browser via cookie tossing, and then perform a CSRF attack after the victim authenticates. As a solution, newer versions of `@fastify/passport` include the configuration options: `clearSessionOnLogin (default: true)` and `clearSessionIgnoreFields (default: ['passport', 'session'])` to clear all
- Product
- fastify-passport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheatsheetseries.owasp.orggithub.com
Apr 21, 2023@fastify/passport is a port of passport authentication library for the Fastify ecosystem.CVE-2023-29019 · Other software · fastify · reported by GitHubHigh 8.1
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid `sessionId` cookie in the victim's browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- fastify-passport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport.CVE-2022-23505 · Other software · auth0 · reported by GitHubMedium 5.3
Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.
- Product
- passport-wsfed-saml2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml.CVE-2022-39300 · Other software · node-saml · reported by GitHubHigh 7.7
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
- Product
- node-saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library.CVE-2022-39299 · Other software · node-saml · reported by GitHubHigh 7.4
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.
- Product
- passport-saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 1, 2022This affects the package passport before 0.6.0.CVE-2022-25896 · Other software · Passport Project · reported by report@snyk.ioMedium 4.8
This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
- Product
- Passport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow.CVE-2022-26953 · Other software · Digi · reported by MITREHigh 7.5
Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint, allowing him to force an overflow when the string is concatenated to the HTML body.
- Product
- Passport Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhub.digi.com
Apr 5, 2022Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is CVE-2022-26952 · Other software · Digi · reported by MITREHigh 7.5
Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page.
- Product
- Passport Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhub.digi.com
Sep 27, 2021The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token.CVE-2021-41580 · Other software · Passportjs · reported by MITREMedium 5.3
The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability
- Product
- Passport-oauth2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2021Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library.CVE-2021-39171 · Other software · node-saml · reported by GitHubMedium 5.3
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
- Product
- passport-saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2019Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing.CVE-2019-13483 · Email & office · Auth0 · reported by MITREHigh 7.3
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
- Product
- Passport-sharepoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth CVE-2018-17500 · Other software · Envoy · reported by psirt@us.ibm.comLow 2.9
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information.
- Product
- Envoy Passport for iPhone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Mar 21, 2019Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted dataCVE-2018-17499 · Other software · Envoy · reported by psirt@us.ibm.comLow 2.9
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information.
- Product
- Envoy Passport for iPhone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 8, 2019LifeSize Team, Room, Passport, and Networker 220 devices allow Authenticated Remote OS Command Injection, as demonstrated by shell metacharacters in the supportCVE-2019-7632 · Other software · Lifesize · reported by MITREHigh 8.8
LifeSize Team, Room, Passport, and Networker 220 devices allow Authenticated Remote OS Command Injection, as demonstrated by shell metacharacters in the support/mtusize.php mtu_size parameter. The lifesize default password for the cli account may sometimes be used for authentication.
- Product
- Team 220 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrustwave.comtrustwave.com
Jun 5, 2018An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js.CVE-2018-10966 · Other software · Gamerpolls · reported by MITREHigh 7.3
An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js. An attacker can edit the Passport.js contents of the session cookie to contain the ID number of the account they wish to take over, and re-sign it using the hard coded secret.
- Product
- Gamerpolls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5.CVE-2017-16897 · Other software · Auth0 · reported by MITREHigh 8.1
A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).
- Product
- Passport-wsfed-saml2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2016The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateICVE-2016-7191 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
- Product
- Azure Active Directory Passport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.