56694 matches found
CVE-2025-62041
creationtimestamp| type| source ---|---|--- 2026-01-20 20:15:18+00:00| seen| Telegram/1Aym9ybiLzDbFFE37fAEjJeS7u4Gmv4IykqESMsTc4nvMg...
CVE-2025-60208
creationtimestamp| type| source ---|---|--- 2026-01-20 20:06:11+00:00| seen| Telegram/tqnWwDbc3BXy2dd28UIgqchlqEfcA1hQDKukGhu3UglvqY...
CVE-2025-48106
creationtimestamp| type| source ---|---|--- 2026-01-20 20:01:05+00:00| seen| Telegram/2h9kLqrsex2tcWpWJqm-roNL4IgbxPNBh636PPsjj82mNAo...
Insufficient Session Expiration
Overview @hotwired/turbo is a The speed of a single-page web application without having to write any JavaScript Affected versions of this package are vulnerable to Insufficient Session Expiration due to a race condition. An attacker can cause stale session cookies to be restored by delaying HTTP...
CVE-2025-67263
Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting XSS vulnerability in the Clients module. The application fails to properly sanitize user-supplied input stored in the Name and Surname fields. An attacker can insert malicious HTML or script content into these...
CVE-2025-36410
IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security...
CVE-2025-36410 Multiple vulnerabilities found in IBM ApplinX.
IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security...
CVE-2025-36410 Multiple vulnerabilities found in IBM ApplinX.
IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security...
CVE-2025-36410
CVE-2025-36410 affects IBM ApplinX 11.1. An authenticated user could perform unauthorized administrative actions on the server due to server-side enforcement of client-side security. The Red Hat, CIRCL, NVD, and IBM bulletin entries corroborate the same description and indicate the issue resides ...
CVE-2025-36410
IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security...
GHSA-7VW6-5Q2F-7W5R Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)
A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...
Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)
A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...
postgresql: libpq: libpq undersizes allocations, via integer wraparound
A vulnerability has been identified in PostgreSQL’s libpq client library, where integer wraparound in several allocation-size calculations allows a peer or input provider to cause an undersized buffer and then write out-of-bounds by hundreds of megabytes. This can lead to a client application...
Server-side Request Forgery (SSRF)
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the jwksuri parameter in the OpenID Connect Dynamic Client Registration...
CVE-2026-1180
A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...
CVE-2026-1180
A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...
CVE-2026-1180 Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uri
A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...
CVE-2026-1180 Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uri
A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...
CVE-2026-1180
CVE-2026-1180 describes a SSRF risk in Keycloak’s OpenID Connect Dynamic Client Registration when using private_key_jwt. A client can specify an arbitrary jwks_uri, and Keycloak fetches it without validating the destination, potentially making HTTP requests to internal or restricted network resou...