SUSE SLED15 / SLES15 Security Update : python-Authlib (SUSE-SU-2026:4111-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4111-1 advisory. This update for python-Authlib fixes the following issue: - CVE-2026-41479: crafted authorization requests with...

Security update for python-Authlib

This update for python-Authlib fixes the following issue: CVE-2026-41479: crafted authorization requests with unsupported responsetypes can cause unauthenticated open redirects bsc1275231. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:4111-1 Security update for python-Authlib

This update for python-Authlib fixes the following issue: - CVE-2026-41479: crafted authorization requests with unsupported responsetypes can cause unauthenticated open redirects bsc1275231...

openSUSE 16 Security Update : python-Authlib (openSUSE-SU-2026:21795-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21795-1 advisory. Changes in python-Authlib: - CVE-2026-41479: Open Redirect vulnerability via crafted authorization requests bsc1275231 Tenable has extracted the precedi...

Security update for python-Authlib (moderate)

openSUSE security update: security update for python-authlib ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21795-1 Rating: moderate References: bsc1275231 Cross-References: CVE-2026-41479 CVSS scores: CVE-2026-41479 SUSE : 5.4...

OPENSUSE-SU-2026:21795-1 Security update for python-Authlib

This update for python-Authlib fixes the following issues: Changes in python-Authlib: - CVE-2026-41479: Open Redirect vulnerability via crafted authorization requests bsc1275231...

CVE-2026-18572

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

CVE-2026-18572 Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

CVE-2026-18572

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

FastMCP 安全漏洞

FastMCP is a MCP server-building software developed by Jeremiah Lowin. Versions of FastMCP prior to 2.14.2 contained security vulnerabilities. These vulnerabilities stemmed from servers failing to properly handle resource parameters submitted by clients during authorization and token requests. As...

Security Updates for Microsoft SQL Server (January 2026)

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability CVE-2026-20803. An authenticated attacker who successfully exploited this vulnerability could gain elevated privileges on the SQL Server...

EUVD-2022-6482

Malicious code in bioql PyPI...

PT-2025-3103 · Unknown +1 · Vaultwarden +1

Name of the Vulnerable Software and Affected Versions: Vaultwarden versions prior to 1.32.5 Description: An issue in the component src/api/identity.rs of Vaultwarden allows attackers to impersonate users, including Administrators, via a crafted authorization request. This issue enables attackers ...

CVE-2024-55225

CVE-2024-55225 affects Vaultwarden prior to v1.32.5. The issue resides in the component src/api/identity.rs and allows attackers to impersonate users (including Administrators) via a crafted authorization request. Public details indicate a user-impersonation vulnerability with high impact (CVE ha...

VulnCheck KEV: CVE-2016-4977

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

The vulnerability of the OAuth 2.0 authorization mechanism for Pushed Authorization Requests in the software tool for managing identity verification and access in Keycloak allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the OAuth 2.0 Pushed Authorization Request mechanism in the software for managing identity verification and access involves the storage of sensitive data in an open format within a cookie file called KCRESTART. Exploiting this vulnerability could allow an attacker to gain...

GHSA-69FP-7C8P-CRJR Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)

A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests PAR. Client provided parameters were found to be included in plain text in the KCRESTART cookie returned by the authorization server's HTTP response to a requesturi authorization request. This could lead to an information...

Low: Red Hat Security Advisory: Red Hat build of Keycloak 24.0.5 Images enhancement and security update

New images are available for Red Hat build of Keycloak 24.0.5 and Red Hat build of Keycloak 24.0.5 Operator, running on OpenShift Container Platform Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which give...

keycloak: exposure of sensitive information in Pushed Authorization Requests (PAR) KC_RESTART cookie

A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests PAR. Client-provided parameters were found to be included in plain text in the KCRESTART cookie returned by the authorization server's HTTP response to a requesturi authorization request, possibly leading to an information...

keycloak: exposure of sensitive information in Pushed Authorization Requests (PAR) KC_RESTART cookie

A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests PAR. Client-provided parameters were found to be included in plain text in the KCRESTART cookie returned by the authorization server's HTTP response to a requesturi authorization request, possibly leading to an information...