https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-5390.htmlhttps://patchthecve.com/cve/CVE-2020-5390.htmlWed, 17 Jun 2026 03:21:23 +0000HIGH 7.5: PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verifihttps://patchthecve.com/cve/CVE-2017-1000433.htmlhttps://patchthecve.com/cve/CVE-2017-1000433.htmlWed, 17 Jun 2026 00:59:10 +0000HIGH 8.1: pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.https://patchthecve.com/cve/CVE-2017-1000246.htmlhttps://patchthecve.com/cve/CVE-2017-1000246.htmlWed, 17 Jun 2026 00:58:58 +0000MEDIUM 5.3: Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.https://patchthecve.com/cve/CVE-2016-10149.htmlhttps://patchthecve.com/cve/CVE-2016-10149.htmlWed, 17 Jun 2026 00:39:09 +0000HIGH 7.5: XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.https://patchthecve.com/cve/CVE-2016-10127.htmlhttps://patchthecve.com/cve/CVE-2016-10127.htmlWed, 17 Jun 2026 00:39:06 +0000CRITICAL 9.0: PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.