Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 06:29:58 +0000 CVE-2026-84941 — Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read https://vulnerability.circl.lu/vuln/cve-2026-84941 <p><strong>Affected:</strong> TP-Link Systems Inc. Omada Software Controller (Windows), TP-Link Systems Inc. Omada Software Controller (Linux), TP-Link Systems Inc. OC2000 v1, TP-Link Systems Inc. OC2000 v2, TP-Link Systems Inc. OC200 v3, TP-Link Systems Inc. OC220 v1, TP-Link Systems Inc. OC220 v2, TP-Link Systems Inc. OC300 v1, TP-Link Systems Inc. OC400 v1</p> <p>An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.</p> <p><strong>Affected:</strong> TP-Link Systems Inc. Omada Software Controller (Windows), TP-Link Systems Inc. Omada Software Controller (Linux), TP-Link Systems Inc. OC2000 v1, TP-Link Systems Inc. OC2000 v2, TP-Link Systems Inc. OC200 v3, TP-Link Systems Inc. OC220 v1, TP-Link Systems Inc. OC220 v2, TP-Link Systems Inc. OC300 v1, TP-Link Systems Inc. OC400 v1</p> <p>An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.</p> https://vulnerability.circl.lu/vuln/cve-2026-84941