{"items":[{"id":"CVE-2026-49289","published":"2026-08-19T14:48:52.694Z","updated":"2026-08-19T18:04:15.406Z","title":"SimpleSAMLphp SAML2: Possible DoS via XPath Transform","severity":"HIGH","score":7.5,"vendor":"simplesamlphp","product":"saml2","kev":false,"epss":0.00784,"kevAdded":null},{"id":"CVE-2026-49283","published":"2026-08-19T14:47:05.519Z","updated":"2026-08-19T18:19:10.978Z","title":"SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass","severity":"HIGH","score":8.7,"vendor":"simplesamlphp","product":"saml2","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2026-49284","published":"2026-07-17T19:17:23.897Z","updated":"2026-07-20T19:22:12.247Z","title":"SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`","severity":"HIGH","score":7.1,"vendor":"simplesamlphp","product":"simplesamlphp","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-46491","published":"2026-06-09T23:00:11.313Z","updated":"2026-06-10T18:11:30.420Z","title":"SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion","severity":"HIGH","score":8.6,"vendor":"simplesamlphp","product":"simplesamlphp-module-casserver","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2025-65954","published":"2026-05-18T19:57:07.228Z","updated":"2026-05-18T20:28:06.383Z","title":"SimpleSAMLphp-casserver  has an Open Redirect vulnerability via logout","severity":"MEDIUM","score":4.7,"vendor":"simplesamlphp","product":"simplesamlphp-module-casserver","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-32600","published":"2026-03-13T19:58:41.692Z","updated":"2026-03-16T14:03:17.811Z","title":"xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption","severity":"HIGH","score":8.2,"vendor":"simplesamlphp","product":"xml-security","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-27773","published":"2025-03-11T19:04:52.135Z","updated":"2025-05-09T20:03:38.107Z","title":"SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding","severity":"HIGH","score":8.6,"vendor":"simplesamlphp","product":"saml2","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2024-52596","published":"2024-12-02T16:24:49.591Z","updated":"2024-12-02T18:36:23.399Z","title":"SimpleSAMLphp xml-common XXE vulnerability","severity":"HIGH","score":8.8,"vendor":"simplesamlphp","product":"xml-common","kev":false,"epss":0.00979,"kevAdded":null},{"id":"CVE-2024-52806","published":"2024-12-02T16:18:43.485Z","updated":"2024-12-02T19:12:33.197Z","title":"SimpleSAMLphp SAML2 has an XXE in parsing SAML messages","severity":"HIGH","score":8.3,"vendor":"simplesamlphp","product":"saml2","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2023-49087","published":"2023-11-30T05:20:28.298Z","updated":"2024-08-02T21:46:29.195Z","title":"Validation of SignedInfo","severity":"MEDIUM","score":6.8,"vendor":"simplesamlphp","product":"xml-security","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2010-10008","published":"2023-01-17T07:35:29.073Z","updated":"2024-11-25T16:35:21.618Z","title":"simplesamlphp simplesamlphp-module-openidprovider trust.tpl.php cross site scripting","severity":"LOW","score":3.5,"vendor":"simplesamlphp","product":"simplesamlphp-module-openidprovider","kev":false,"epss":0.00589,"kevAdded":null},{"id":"CVE-2010-10002","published":"2023-01-01T16:16:09.396Z","updated":"2024-08-07T04:17:10.242Z","title":"SimpleSAMLphp simplesamlphp-module-openid OpenID consumer.php cross site scripting","severity":"LOW","score":3.1,"vendor":"SimpleSAMLphp","product":"simplesamlphp-module-openid","kev":false,"epss":0.00695,"kevAdded":null},{"id":"CVE-2020-5301","published":"2020-04-21T19:50:13.000Z","updated":"2024-08-04T08:22:09.096Z","title":"Information disclosure of source code in SimpleSAMLphp","severity":"LOW","score":3,"vendor":"simplesamlphp","product":"simplesamlphp","kev":false,"epss":0.00922,"kevAdded":null},{"id":"CVE-2020-5226","published":"2020-01-24T21:15:15.000Z","updated":"2024-08-04T08:22:08.731Z","title":"Cross-site scripting in SimpleSAMLphp","severity":"MEDIUM","score":4.4,"vendor":"simplesamlphp","product":"SimpleSAMLphp","kev":false,"epss":0.00544,"kevAdded":null},{"id":"CVE-2020-5225","published":"2020-01-24T20:55:14.000Z","updated":"2024-08-04T08:22:08.946Z","title":"Log injection in SimpleSAMLphp","severity":"MEDIUM","score":4.4,"vendor":"simplesamlphp","product":"SimpleSAMLphp","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2011-4625","published":"2019-11-06T14:53:31.000Z","updated":"2024-08-07T00:09:19.359Z","title":"simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.","severity":"HIGH","score":7.5,"vendor":"simplesamlphp","product":"simplesamlphp","kev":false,"epss":0.00744,"kevAdded":null}]}