Lucene search
+L

90173 matches found

Vulnrichment
Vulnrichment
added 2026/07/03 3:16 p.m.11 views

CVE-2026-14613 Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...

4.3CVSS6AI score0.00172EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/03 3:16 p.m.31 views

CVE-2026-14613

Technical details are not publicly available in the provided documents. Monitor for updates from Red Hat/NVD for affected Keycloak FGAP v2 integration and any patched versions.

4.3CVSS6AI score0.00172EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/07/03 3:10 p.m.24 views

CVE-2026-14613

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...

4.3CVSS6AI score0.00172EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/03 4:30 a.m.15 views

CVE-2026-11397

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpieimportuploadfilefromurl AJAX action. The plugin's URL downloader first calls wpsaferemoteget which correctly blocks private/reserved IP ranges, but wh...

5.5CVSS5.9AI score0.00228EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/07/03 4:30 a.m.19 views

EUVD-2026-41489

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpieimportuploadfilefromurl AJAX action. The plugin's URL downloader first calls wpsaferemoteget which correctly blocks private/reserved IP ranges, but wh...

5.5CVSS5.9AI score0.00228EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/07/03 1:28 a.m.13 views

CVE-2026-12920

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 4.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

4.9CVSS5.8AI score0.00292EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/07/03 1:28 a.m.17 views

EUVD-2026-41469

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 4.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

4.9CVSS5.8AI score0.00292EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/07/03 12:31 a.m.14 views

EUVD-2026-41466

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks...

5.4CVSS5.6AI score0.00271EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/03 12:16 a.m.14 views

CVE-2026-54477

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks...

5.4CVSS0.00271EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/03 12:0 a.m.28 views

PT-2026-55550

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the ClientResource component of the admin services when Fine-Grained Admin Permissions FGAP v2 is enabled. This issue allows a delegated administrator with limited control...

5.4CVSS6AI score0.00188EPSS
SaveExploits0References6
Tenable Nessus
Tenable Nessus
added 2026/07/03 12:0 a.m.19 views

Apache ActiveMQ < 5.19.8 / 6.x < 6.2.7 Multiple Vulnerabilities

The version of Apache ActiveMQ running on the remote host is prior to 5.19.8 or 6.x prior to 6.2.7. It is, therefore, affected by multiple vulnerabilities: - Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that...

8.1CVSS6.2AI score0.01177EPSS
SaveExploits0References16
Positive Technologies
Positive Technologies
added 2026/07/03 12:0 a.m.19 views

PT-2026-55549

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An issue in the administrative interface occurs when Fine-Grained Admin Permissions FGAP v2 are enabled. An administrator with permission to view a specific role can access a list of all...

4.3CVSS6.1AI score0.00172EPSS
SaveExploits0References6
Tenable Nessus
Tenable Nessus
added 2026/07/03 12:0 a.m.14 views

Keycloak < 26.6.4 Multiple Vulnerabilities

The version of Keycloak installed on the remote host is prior to 26.6.4. It is, therefore, affected by multiple vulnerabilities, including the following: - A user with group-admin privileges can escalate to realm-admin, gaining full administrative control over the realm. CVE-2026-9099 - An...

8.1CVSS6.1AI score0.00519EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/07/02 11:52 p.m.66 views

CVE-2026-54477 Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks...

5.4CVSS0.00271EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/02 11:52 p.m.10 views

CVE-2026-54477

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks...

5.4CVSS5.8AI score0.00271EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/02 11:52 p.m.41 views

CVE-2026-54477

CVE-2026-54477 affects the Gardyn IoT Hub admin panel, where the absence of standard security headers allows clickjacking and cross-site scripting. The available data show an impact with low confidentiality and integrity impact (CVSS scores: 5.1/4.0 base metrics, MEDIUM), but no explicit details ...

5.4CVSS5.6AI score0.00271EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/02 11:6 p.m.16 views

CVE-2026-13722

WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image.This vulnerability affects Fireware OS 11.0 up to and including...

8.6CVSS5.7AI score0.00232EPSS
SaveExploits0References2Affected Software1
Snyk
Snyk
added 2026/07/02 10:18 p.m.7 views

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the assignRoleToUser and assignRoleToGroup handlers. An attacker can gain unauthorized administrative privileges by assigning high-privilege roles, such as the built-in admin role, to themselves or...

8.8CVSS6AI score0.00389EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/02 8:17 p.m.13 views

CVE-2026-59093

Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. The assignRoleToUser and assignRoleToGroup handlers POST /authz/users/id/assign and /authz/groups/id/assign authorize only that the caller may assign role...

8.8CVSS0.00389EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/02 8:17 p.m.20 views

CVE-2026-58466

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via adddefaultuser in the database user module when the users table is empt...

9.8CVSS0.00505EPSS
SaveExploits0References4
Rows per page
Query Builder