1
CVEs
0
Critical
1
High
0
KEV
0
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75807 | Authentication bypass in the miniOrange SAML Single Sign On - SSO Login WordPress plugin (versions ≤5.4.6) allows a remote, unauthenticated attacker to overwrite the plugin's stored IdP X.509 signing certificate and subsequently forge SAML assertions to obtain a fully privileged session as any WordPress account, including administrators. The flaw originates in the ACS handler persisting an attacker-supplied certificate from an incoming SAMLResponse before signature validation is enforced - a logic ordering error that wholly undermines SAML trust. Exploitation is gated by a required administrator interaction (triggering the test_config_error_wpsamlerr004 repair flow), and no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
No patch
|