40905 matches found
keycloak-services: keycloak-services: Broker-originated username collision causes account lockout
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...
CVE-2026-91843
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges...
CVE-2026-19607
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...
CVE-2026-92141
Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
EUVD-2026-80699
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges...
CVE-2026-91843 Stack overflow in login process to the Security Management and Log Servers
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges...
CVE-2026-91843 Stack overflow in login process to the Security Management and Log Servers
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges...
CVE-2026-91843
CheckPoint Security Management and Log Servers are affected by a stack overflow in the unauthenticated login process , which may allow a remote attacker to execute arbitrary code with root privileges . The vulnerability is rated CVSS 9.8 (Critical) with a network attack vector requiring no privil...
SUSE-SU-2026:4211-1 Security update for kbd
This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that allows passwordless root login bsc1275441...
Security update for kbd
This update for kbd fixes the following issue: CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that allows passwordless root login bsc1275441. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...
DEBIAN-CVE-2026-90011
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds MAXKEYVALUEPAIRS, but the test is '' and login-reqbuf is allocated with exactly...
CVE-2026-82311
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...
CVE-2026-82311 Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...
EUVD-2026-80318
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...
CVE-2026-82311 Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...
Security update for kbd
This update for kbd fixes the following issue: CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that allows passwordless root login bsc1275441. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...
SUSE-SU-2026:4207-1 Security update for kbd
This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that allows passwordless root login bsc1275441...
CVE-2026-27546
An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...
CVE-2026-27546 Authentication Bypass in _account_log
An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...