Veille CVE

Semaine du 24 août au 30 août 2026

2 CVE

Critique 1 Élevée 0 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Google SAM » ✕
  1. CVE-2026-77998 10.0 Critique

    miniorange.com SAML SSO Free for Joomla extension for Joomla · miniorange.com SAML SSO Basic for Joomla extension for Joomla · miniorange.com SAML SSO Standard for Joomla extension for Joomla · miniorange.com SAML SSO Premium for Joomla extension for Joomla

    Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.

  2. CVE-2025-36939 5.7 Moyenne

    Google Nest · Google nest wifi router firmware · Google nest wifi point firmware · Google nest wifi pro firmware

    Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow.