Cryptography

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing a…CVE-2019-3465Simplesamlphp · 3.0% likely

   CWE-347

2. The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a cr…CVE-2018-7644Simplesamlphp · 1.5% likely

   CWE-347

3. HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get inv…CVE-2018-7711Simplesamlphp · 1.2% likely

   CWE-347

4. A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML respons…CVE-2017-18122Simplesamlphp · 1.1% likely

   CWE-347

5. The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protectio…CVE-2017-12871Simplesamlphp · 0.5% likely

   CWE-326

6. SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypassCVE-2026-49283simplesamlphp · CVSS 8.7 · 0.5% likely

   CWE-295

7. SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect bindingCVE-2025-27773simplesamlphp · CVSS 8.6 · 0.4% likely

   CWE-347

8. SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`CVE-2026-49284simplesamlphp · CVSS 7.1 · 0.2% likely

   CWE-345

9. Validation of SignedInfoCVE-2023-49087simplesamlphp · CVSS 6.8 · 0.2% likely

   CWE-345

10. xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized DecryptionCVE-2026-32600simplesamlphp · CVSS 8.2 · 0.2% likely

    CWE-354

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.