281 matches found
CVE-2026-23552 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...
CVE-2026-27133
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA Certificate Authority certificates is used in the trusted certificates configuration of a Kafka Connect opera...
openSUSE 16 Security Update : tailscale (openSUSE-SU-2026:20192-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20192-1 advisory. Changes in tailscale: - Update to version 1.94.0: IS SET and NOT SET have been added as device posture operators India DERP Region City Name...
Updated ceph packages fix security vulnerability
Updated ceph packages fix a security issue allowing an attacker to make Ceph accept any certificate...
BIT-PYTHON-2025-12781 base64.b64decode() always accepts "+/" characters, despite setting altchars
When passing data to the b64decode, standardb64decode, and urlsafeb64decode functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. Th...
CVE-2023-4258
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee...
SUSE SLES12 Security Update : curl (SUSE-SU-2026:0066-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0066-1 advisory. - CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect bsc1255731 - CVE-2025-15079: Fixed unknown host connection acceptance when...
SUSE-SU-2026:0066-1 Security update for curl
This update for curl fixes the following issues: - CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect bsc1255731 - CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile bsc1255733 - CVE-2025-14819: Fixed issue where alteration of...
CVE-2019-12425
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...
PT-2025-53800
Name of the Vulnerable Software and Affected Versions Micro Registration Utility µURU versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893 Description The Micro Registration Utility µURU, a telephone self registration utility based on asterisk, contains a flaw due to...
EUVD-2025-203443
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened unattended...
CVE-2025-64725
CVE-2025-64725 affects Weblate (web-based localization tool). Multiple sources confirm a flaw in the invitation-acceptance flow: an invitation opened by one user could be accepted by another due to improper validation prior to version 5.15. The vulnerability enables unauthorized access to invitat...
Incorrect User Management
Overview Affected versions of this package are vulnerable to Incorrect User Management in the invitation acceptance process. An attacker can gain unauthorized access to invitations intended for other users by accepting an invitation link that was opened by a different user. Workaround This...
Weblate has improper validation upon invitation acceptance
Impact It was possible to accept an invitation opened by a different Weblate user. Patches https://github.com/WeblateOrg/weblate/pull/16913 Workarounds Users should avoid leaving Weblate sessions with an unattended opened invitation. References Thanks to Nahid0x for responsibly disclosing this...
CLSA-2025-1764321653 bind: Fix of CVE-2025-40778
CVE-2025-40778: fix issue with BIND being too lenient when accepting records from answers to prevent the injection of forged data into the cache...
Astra Linux - уязвимость в linux-5.10
In the Linux kernel, the following vulnerability has been resolved: efi/unaccepted: touch soft lockup during memory accept Commit 50e782a86c98 "efi/unaccepted: Fix soft lockups caused by parallel memory acceptance" has released the spinlock so other CPUs can do memory acceptance in parallel and n...
UBUNTU-CVE-2025-40778
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through...
EUVD-2021-12587
Malware in sbrugna...