15869 matches found
keycloak: Incorrect ownership checks in /uma-policy/
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService UMA Protection API. When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first...
K000159896: Golang vulnerability CVE-2025-61723
Security Advisory Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. CVE-2025-61723 Impact An attacker may be able to exploit this vulnerability, causing the affected...
CVE-2026-0106: Improper Restriction of Operations within the Bounds of a Memory Buffer
In vpummap of vpuioctl, there is a possible arbitrary address mmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-25055: Improper Limitation of a Pathname to a Restricted Directory
n8n is an open source workflow automation platform. Prior to versions 1.123.12 and 2.4.0, when workflows process uploaded files and transfer them to remote servers via the SSH node without validating their metadata the vulnerability can lead to files being written to unintended locations on those...
AList 路径遍历漏洞
AList is a file list program developed by Xhofe, a developer from China. Versions of AList prior to 3.57.0 had a path traversal vulnerability. This vulnerability stemmed from vulnerabilities in multiple file operation handlers, which could lead to unauthorized file operations...
Photon OS 4.0: Glib PHSA-2026-4.0-0943
An update of the glib package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-0943. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
OPENSUSE-RU-2026:20168-1 Recommended update for gimp
This update for gimp fixes the following issues: Changes in gimp: - Update to 3.0.8 - Font Loading Performance - Improvements in start-up time for users with a large number of fonts was backported from our 3.2 RC2 release. As a result, we now wait to load images until fonts are initialized - this...
ICYMI: Experts on Experts – Season One Roundup
In 2025, we launched Experts on Experts: Commanding Perspectives as a pilot video series designed to spotlight the ideas shaping cybersecurity, directly from the people driving them. Over five episodes, Rapid7 leaders shared short, candid conversations on topics like agentic AI, MDR ROI,...
CVE-2025-61649: Improper Limitation of a Pathname to a Restricted Directory
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Services/CheckUserUserInfoCardService.Php. This issue affects CheckUser: from 7cedd58781d261f110651b6af4f41d2d11ae7309...
CVE-2025-61647: Improper Limitation of a Pathname to a Restricted Directory
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Api/Rest/Handler/UserInfoHandler.Php. This issue affects CheckUser: from a3dc1bbcc33acbcca6831d6afaccbb1054c93a57, 0584eb2ad564648aa3ce9c555dd044dda02b55f4...
CVE-2025-61653: Improper Limitation of a Pathname to a Restricted Directory
Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects TextExtracts: from before 1.39.14, 1.43.4, 1.44.1...
CVE-2026-1186
EAP Legislator is vulnerable to Path Traversal in file extraction functionality. Attacker can prepare zipx archive default file type used by the Legislator application and choose arbitrary path outside the intended directory e.x. system startup where files will be extracted by the victim upon...
CVE-2025-6597: Improper Limitation of a Pathname to a Restricted Directory
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWiki: from before 1.39.13, 1.42.7, 1.43.2, 1.44.0...
CVE-2025-36253: Use of a One-Way Hash without a Salt
IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...
CLEANSTART-2026-GQ48460 Cancelling a query (e
Security vulnerability affects the minio-operator-fips package. Cancelling a query e...
CLEANSTART-2026-FD27182 Cancelling a query (e
Security vulnerability affects the kyverno-fips package. Cancelling a query e...
CLEANSTART-2026-HU01783 Cancelling a query (e
Multiple security vulnerabilities affect the kyverno-fips package. Cancelling a query e. See references for individual vulnerability details...
CLEANSTART-2026-KQ33111 Cancelling a query (e
Multiple security vulnerabilities affect the kyverno-policy-reporter-fips package. Cancelling a query e. See references for individual vulnerability details...