693 matches found
CVE-2026-63745: Authorization Bypass Through User-Controlled Key
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...
CVE-2026-63896
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...
CVE-2026-63896 usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...
CVE-2026-63896
The CVE-2026-63896 entry documents a Linux kernel flaw in usb: gadget: composite: GET_URL handling for WebUSB, where landing_page_length is miscomputed as an unsigned difference when wLength
CVE-2026-63896 usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...
CVE-2026-63896
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...
CVE-2026-16106
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...
EUVD-2026-45224
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...
CVE-2026-16106 Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...
CVE-2026-16106
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...
CVE-2026-16106
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...
PT-2026-60801
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the admin REST API of Keycloak, an identity and access management solution. The issue occurs when a delegated administrator attempts to remove a child role from a composite...
Linux Distros Unpatched Vulnerability : CVE-2026-59199
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates ne...
SUSE CVE-2026-59199
Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste, Image.crop, or Image.alphacomposite. This issue is fixed in version 12.3.0...
Missing Authorization
Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization in the RoleContainerResource admin REST composite-role endpoints. A delegated...
Missing Authorization
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization in the RoleContainerResource admin REST composite-role endpoints. A delegated...
BIT-PILLOW-2026-59199 Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste, Image.crop, or Image.alphacomposite. This issue is fixed in version 12.3.0...
Missing Authorization
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization in the admin REST API through the deleteComposites role-composite deletion path in...