nextflow auth login command has incorrect default permissions

CVE-2026-48722

### Impact `nextflow auth login` persists Seqera Platform OIDC tokens to `${NXF_HOME:-~/.nextflow}/seqera-auth.config`.

历史摘要 · 未重新核验 · GitHub Advisory

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

CVE-2026-45052

## Summary **Description** An Improper Authorization (CWE-285) issue in OpenAM's Liberty Web Services SOAP receiver al

历史摘要 · 未重新核验 · GitHub Advisory

OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

CVE-2026-45051

## Summary **Description** A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn aut

历史摘要 · 未重新核验 · GitHub Advisory

OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation

CVE-2026-48480

The codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final ch

历史摘要 · 未重新核验 · GitHub Advisory

jackson-databind has @JsonView bypass for setterless creator properties

CVE-2026-54517

## Summary In `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only t

历史摘要 · 未重新核验 · GitHub Advisory

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

CVE-2026-54516

## Summary `POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty("renamed")` on the getter

历史摘要 · 未重新核验 · GitHub Advisory

jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

CVE-2026-54515

## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by

历史摘要 · 未重新核验 · GitHub Advisory

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

CVE-2026-46495

## Summary **Description** A Deserialization of Untrusted Data (CWE-502) issue in OpenDJ's JMX RMI connector allows an

历史摘要 · 未重新核验 · GitHub Advisory

Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types

CVE-2026-44795

### Impact There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when w

历史摘要 · 未重新核验 · GitHub Advisory

OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`

CVE-2026-44793

## Summary Certain federation endpoints do not consistently apply output encoding when rendering user-supplied paramete

历史摘要 · 未重新核验 · GitHub Advisory

OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

CVE-2026-44203

### Summary The OAuth 2.0 / OpenID Connect authorization endpoint does not sufficiently sanitize certain user-supplied

历史摘要 · 未重新核验 · GitHub Advisory

OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

CVE-2026-44202

OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock O

历史摘要 · 未重新核验 · GitHub Advisory

xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro

CVE-2026-44179

### Summary The excerpt-include macro does not properly escape the title of the included page and executes the content o

历史摘要 · 未重新核验 · GitHub Advisory

OpenAM has LDAP Injection via `_queryId` Parameter

CVE-2026-41573

OpenAM (Open Identity Platform) is an open-source IAM platform providing SSO, OAuth2, SAML, and OpenID Connect capabilit

历史摘要 · 未重新核验 · GitHub Advisory

OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

### Summary OpenRemote Manager is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) in the bulk alarm

历史摘要 · 未重新核验 · GitHub Advisory

http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments

### Impact `ServerFilters.DigestAuth` and the underlying `DigestAuthProvider` both defaulted their `nonceVerifier` para

历史摘要 · 未重新核验 · GitHub Advisory

http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default

### Impact The previous `BasicCookieStorage` did not enforce RFC 6265 scoping rules around cookie domain, path, and `Se

历史摘要 · 未重新核验 · GitHub Advisory

http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`

### Impact The `HmacSha256` class contained two functions: - `hash(payload)` — a plain unkeyed SHA-256 digest. The `Hma

历史摘要 · 未重新核验 · GitHub Advisory

http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`

### Impact `reverseProxy()` and `reverseProxyRouting()` matched configured vhosts by substring on the `Host` header (`C

历史摘要 · 未重新核验 · GitHub Advisory

Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering

CVE-2026-55847

## Summary The `ansi.js` Handlebars helper in allure-generator passes user-controlled `statusMessage` and `statusTrace`

历史摘要 · 未重新核验 · GitHub Advisory