CVE-2026-68757

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

A user with access to a valid SAML response may impersonate another user under specific conditions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

VendorProductVersions
jfrogartifactory< 7.146.35; >= 7.161.0, < 7.161.16

References

Timeline

Published
Aug 12, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-687586.5A low-privileged authenticated user may access restricted support information under specific conditions.CVE-2026-687597.2A holder of a valid integration credential may impersonate other users under specific conditions.CVE-2026-687610.0ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allowCVE-2026-687605.3An unauthenticated user may bypass authentication under specific cache conditions.CVE-2026-687625.9In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possibleCVE-2026-687637.5Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reseCVE-2026-687656.1hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301) tCVE-2026-687667.8hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --ouCVE-2026-687676.1hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly thCVE-2026-687686.1hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling outputCVE-2026-68775.3ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates StorCVE-2026-687709.8sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiti