84299 matches found
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-84274 DESCRIPTION: IBM Security Guardium Data Protection is affected by a sensitive information exposure vulnerability. During SECRET and APIKEY rotation processing, sensiti...
CVE-2026-94215
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...
EUVD-2026-83845
A flaw was found in the User-Managed Access UMA implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one...
CVE-2026-94215 Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...
CVE-2026-94215
Keycloak's Admin REST API contains a cross-realm privilege escalation flaw. The API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying realm ownership , allowing a limited-privilege administrator to read or modify client configurations in the master...
EUVD-2026-83841
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...
CVE-2026-94213
CVE-2026-94213 affects the Authorization Services component of Keycloak , an open-source identity and access management solution. The flaw resides in the policy evaluation endpoint , used by administrators to test how access policies apply to specific users. Due to missing authorization checks , ...
CVE-2026-94215
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...
CVE-2026-55870: Exposure of Sensitive Information to an Unauthorized Actor
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...
CVE-2026-79917: Improper Authorization
MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/applicationid/chat/chatid/sharechat verifies that a conversation exists but does not verify that it belongs to the authenticated chatuserid or to the application bound to the caller's token. An attack...
CVE-2026-79316
An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...
PT-2026-96300
Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description An authenticated user with AI feature access can execute dangerous statements or database functions because the runQuery function in server/modules/ai/orchestrator/tools/runQuery.js uses an...
CVE-2026-90860: Improper Removal of Sensitive Information Before Storage or Transfer
The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...
CVE-2026-94215: Missing Authorization
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...
CVE-2026-75158: Exposure of Sensitive Information to an Unauthorized Actor
Apache Airflow's /assets/events API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID,...
CVE-2026-63342: Incorrect Authorization
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...
PT-2026-96131
Name of the Vulnerable Software and Affected Versions GoCD versions 18.3.0 through 26.0.0 Description Stored cross-site scripting occurs when the server generates unescaped tracking-tool links from commit comments. This happens when a project uses a lenient Tracking Tool regular expression with a...
CVE-2026-94213: Missing Authorization
A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization check...
Linux Distros Unpatched Vulnerability : CVE-2026-92747
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual...
