https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2015-3158.htmlhttps://patchthecve.com/cve/CVE-2015-3158.htmlWed, 17 Jun 2026 00:25:26 +0000MEDIUM 4.0: The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) https://patchthecve.com/cve/CVE-2015-6254.htmlhttps://patchthecve.com/cve/CVE-2015-6254.htmlWed, 17 Jun 2026 00:30:34 +0000MEDIUM 6.0: The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unkhttps://patchthecve.com/cve/CVE-2015-0277.htmlhttps://patchthecve.com/cve/CVE-2015-0277.htmlWed, 17 Jun 2026 00:19:53 +0000MEDIUM 6.0: The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due