56428 matches found
EEF-CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Summary Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch...
CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...
CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...
CVE-2026-55953
A flaw was found in the Erlang/OTP ssl client. This vulnerability allows an on-path attacker to bypass server authentication in TLS 1.2 and earlier and DTLS connections. By tricking the client into accepting an unoffered anonymous cipher suite, the attacker can complete the handshake without a...
RLSA-2026:47755 Moderate: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux...
CVE-2026-18382
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and...
CVE-2026-18382 Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and...
EUVD-2026-51095
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and...
CVE-2026-18382
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and...
Missing Authorization
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization due to the full-scope-disabled client-policy executor. An attacker can create a client...
Missing Authorization
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization during client update handling. An attacker can persist a confidential client that does...
Malicious code in phabricator-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...
MAL-2026-11195 Malicious code in phabricator-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...
io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation
A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...
CLEANSTART-2026-WO51731 Security fixes in k8ssandra-client-fips 0.6.4-r7
Package k8ssandra-client-fips version 0.6.4-r7 fixes 10 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...
CLEANSTART-2026-MB96835 Security fixes in k8ssandra-client-fips 0.8.10-r0
Package k8ssandra-client-fips version 0.8.10-r0 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, ghsa-p77j-4mvh-x3m3...
CLEANSTART-2026-UI34592 Security fixes in k8ssandra-client-fips 0.7.0-r2
Package k8ssandra-client-fips version 0.7.0-r2 fixes 16 vulnerabilities: CVE-2025-58187, CVE-2025-58188, CVE-2025-61723, CVE-2025-61725, CVE-2025-61729...
CLEANSTART-2026-EC51762 Security fixes in minio-client-fips 0.20250416181326-r0
Package minio-client-fips version 0.20250416181326-r0 fixes 1 vulnerabilities: CVE-2022-41717...
CLEANSTART-2026-YF94250 Security fixes in k8ssandra-client-fips 0.5.0-r7
Package k8ssandra-client-fips version 0.5.0-r7 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, ghsa-p77j-4mvh-x3m3...