Skip to content

/

ZeroHour

ZeroHour aggregates public sources — security and AI press, vendor advisories, NVD, CISA KEV, FIRST EPSS, leak-site trackers and Have I Been Pwned — and classifies them with AI. Summaries can be wrong: read the original. All times are UTC.

News CVEs Incidents Tags Daily brief Traffic Sources RSS & API Kiosk Health Sitemap

Home
News feed
Exploited now

Security

CVEs
Ransomware & breaches
Threat actors & entities
IOCs

AI

AI & models

Explore

Tags
Daily brief
Analytics
Traffic & readers
Ask the feed
Sources

You

Watchlist
Saved
RSS, API & alerts

07:57 UTC· 5m ago

#syncope — news, CVEs and analysis · ZeroHour

today 46 visits · 59 views · 7 reads·all time 17K views

Tag

#syncope

0 stories this week · 17 this month · 17 in 6 months · mostly security

stories per day · 30 days

Related#apache 17 #iam 7 #authorization-bypass 4 #jwt 3 #authorization 2 #privilege-escalation 2 #access-control 1 #audit-records 1 #cas 1 #connid 1 #console 1 #credential-leak 1 #csv-injection 1 #cve 1 #cve-2026-73191 1 #cve-2026-73195 1 #cve-2026-73236 1 #cve-2026-73370 1

16 stories, newest first · one card per story

oss-security·12d ago

CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass

#apache #cve-2026-87802 #jwt

CVE-2026-87802

1

oss-security·12d ago

CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

#apache #cve-2026-86460 #cypher-injection

CVE-2026-86460

1

oss-security·12d ago

CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search

#apache #cve-2026-82232 #jpa

CVE-2026-82232

oss-security·12d ago

CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

#apache #cve-2026-78336 #oidc

CVE-2026-78336

1

oss-security·12d ago

CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication

#apache #cve-2026-78330 #jwks

CVE-2026-78330

oss-security·12d ago

CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

#apache #console #cve-2026-78318

CVE-2026-78318

1

oss-security·12d ago

CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

#apache #cve-2026-77883 #information-disclosure

CVE-2026-77883

2

oss-security·12d ago

CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective

#access-control #apache #authorization

CVE-2026-77181

oss-security·12d ago

CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable

#apache #audit-records #credential-leak

CVE-2026-75015

1

oss-security·12d ago

CVE-2026-73668: Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values

#apache #authorization-bypass #connid

CVE-2026-73668

oss-security·12d ago

CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions

#apache #authorization-bypass #cve-2026-73579

CVE-2026-73579

1

oss-security·12d ago

CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles

#apache #authorization #cve-2026-73470

CVE-2026-73470

oss-security·12d ago

CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration

#apache #authorization-bypass #cve-2026-73236

CVE-2026-73236

oss-security·12d ago

CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection

#apache #csv-injection #cve-2026-73195

CVE-2026-73195

2

oss-security·12d ago

CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers

#apache #cas #cve-2026-73191

CVE-2026-73191

oss-security·12d ago high

CVE-2026-73178: Apache Syncope: JWT Access Token takeover

#apache #cve #identity-management

CVE-2026-73178

1