611 matches found
Exploit for CVE-2026-23552
CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloa...
PT-2026-7128
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the jwt-authorization-grant flow where the server does not verify if an Identity Provider IdP is enabled before issuing tokens. The lookupIdentityProviderFromIssuer mechanis...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: opentelemetry-operator, gitlab-operator, cert-manager-csi-driver, percona-server-mongodb-operator, mariadb-operator, step-issuer-fips, cert-manager-webhook-pdns-fips, cert-manager-csi-driver-fips, cert-manager-webhook-pdns, cert-manager-openshift-routes,...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: cert-manager-istio-csr, step-issuer, percona-server-mongodb-operator, opentelemetry-operator, cert-manager-cmctl, cert-manager-csi-driver, cert-manager-webhook-pdns, aws-privateca-issuer, mariadb-operator...
GHSA-GX3X-VQ4P-MHHV vulnerabilities
Vulnerabilities for packages: cert-manager-istio-csr, step-issuer, percona-server-mongodb-operator, opentelemetry-operator, cert-manager-cmctl, cert-manager-csi-driver, cert-manager-webhook-pdns, aws-privateca-issuer, mariadb-operator...
GHSA-GX3X-VQ4P-MHHV vulnerabilities
Vulnerabilities for packages: opentelemetry-operator, gitlab-operator, cert-manager-csi-driver, percona-server-mongodb-operator, mariadb-operator, step-issuer-fips, cert-manager-webhook-pdns-fips, cert-manager-csi-driver-fips, cert-manager-webhook-pdns, cert-manager-openshift-routes,...
CLEANSTART-2026-KV78041 processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input
Multiple security vulnerabilities affect the step-issuer-fips package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. See references for individual vulnerability details...
CLEANSTART-2026-OL60454 Within HostnameError
Multiple security vulnerabilities affect the step-issuer package. Within HostnameError. See references for individual vulnerability details...
CLEANSTART-2026-MI26039 Within HostnameError
Multiple security vulnerabilities affect the step-issuer package. Within HostnameError. See references for individual vulnerability details...
CLEANSTART-2026-KC01126 tar
Multiple security vulnerabilities affect the step-issuer package. tar. See references for individual vulnerability details...
GO-2026-4311 Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio
Fulcio is vulnerable to Server-Side Request Forgery SSRF via MetaIssuer Regex Bypass in github.com/sigstore/fulcio...
MiracleLinux 8 : nodejs:14 (AXSA:2022-4368:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4368:01 advisory. nodejs: Improper handling of URI Subject Alternative Names CVE-2021-44531 nodejs: Certificate Verification Bypass via String Injection CVE-2021-4453...
MiracleLinux 8 : openssl-1.1.1k-4.el8 (AXSA:2021-2623:05)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2623:05 advisory. openssl: integer overflow in CipherUpdate CVE-2021-23840 openssl: NULL pointer dereference in X509issuerandserialhash CVE-2021-23841 Tenable has...
MiracleLinux 4 : openssl-1.0.1e-58.0.2.AXS4 (AXSA:2021-2478:04)
The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2478:04 advisory. openssl: integer overflow in CipherUpdate CVE-2021-23840 openssl: NULL pointer dereference in X509issuerandserialhash CVE-2021-23841 Tenable has extracted th...
curl: SSL options ISSUERCERT, EC_CURVES and CRLFILE silently ignored by non-OpenSSL backends
Summary: The SSL options ISSUERCERT, ECCURVES and CRLFILE are silently ignored for e.g. the mbedTLS backend, which allows MITM attacks for the ISSUERCERT and CRLFILE bug, and can reduce the security and compliance by ignoring the specified curve for the ECCURVES bug. Affected version Tested with...
@blockchain-lab-um/ssi-snap (>=1.0.3 <=1.0.7), @i3m/base-wallet (>=1.1.0 <=2.6.1) +50 more potentially affected by unknown CVE via @veramo/data-store (>=0.0.42 <=5.6.0)
@veramo/data-store NPM version =0.0.42, =1.0.3, =1.1.0, =1.1.0, =1.2.0, =1.1.0, =0.2.0, =1.0.0, =1.5.0, =1.5.1, =0.0.1, =0.11.1-next.4, =0.2.1-next.13, =0.8.1-next.272, =0.11.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-38CW-85XC-XR9X...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the metaRegex function. An attacker can access internal network resources by crafting a malicious issuer URL that bypasses validation and causes the system to send HTTP GET requests to arbitrary...
CVE-2026-22772 Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to 1.8.5, Fulcio's metaRegex function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF on...
CVE-2020-24838
An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obtain the private key of the owner issued with a certain 'amount', and the issuedCount can be zero if there is an overflow...