hydra

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Hydra is a hardened, OpenID Certified OAuth 2.0 Server and OpenID Connect Provider optimized for low-latency, high throughput, and low resource consumption. It connects to your existing identity provider through a login and conse...

talos

Chat · Debates · Boletín · Documentación · Probar Ory Network · Empleos Ory Talos es un servidor de claves de API escalable y seguro optimizado para verificación de baja latencia, escalado horizontal y operaciones predecibles. Sigue las mejores prácticas de seguridad establecidas para claves de A...

oathkeeper

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. It follows the BeyondCorp model designed by Google and secures applications in Zero-Trust...

kratos

聊天 · 讨论 · 新闻邮件 · 文档 · 试用Ory Network · 工作机会 Ory Kratos 是一个面向云原生应用的 API 优先身份与用户管理系统。它将登录、注册、恢复、验证和配置文件管理流程集中起来，让你的服务可以直接使用它们，而无需重新实现。 目录 什么是 Ory Kratos？ 为什么选择 Ory Kratos 从 Auth0、Okta 及类似提供商迁移 部署选项 在 Ory Network 上使用 Ory Kratos 自托管 Ory Kratos 快速开始 谁在使用它？ 什么是 Ory Kratos？ Ory Kratos 是一个遵循 云架构最佳实践 的 API...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: goreleaser, kyverno-policy-reporter-fips, kubernetes-event-exporter-fips, argo-cd, argo-rollouts-fips, bento, argo-events, atlantis, atlantis-fips, argo-events-fips, argo-cd-fips, bento-fips, kyverno-policy-reporter, ory-kratos, argo-rollouts, peerdb-flow,...

GHSA-GXHX-2686-5H9G vulnerabilities

Vulnerabilities for packages: goreleaser, kyverno-policy-reporter-fips, kubernetes-event-exporter-fips, argo-cd, argo-rollouts-fips, bento, argo-events, atlantis, atlantis-fips, argo-events-fips, argo-cd-fips, bento-fips, kyverno-policy-reporter, ory-kratos, argo-rollouts, peerdb-flow,...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: commercial-chainloop-backend, gitlab-kas, argo-workflows-fips, wal-g, gitness, sftpgo-plugin-eventsearch, caddy-fips, commercial-grafana, grafana, envoy-gateway, k3s, kube-bench, grafana-alloy, keda-fips, spicedb, cloudnative-pg, azure-service-operator, vault,...

SUSE CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

SUSE CVE-2026-33496

ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The oauth2introspection authenticator cache does not distingui...

SUSE CVE-2026-33503

Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the ListCourierMessages Admin API in Ory Kratos is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configur...

SUSE CVE-2026-33504

Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers Admin APIs in Ory Hydra are vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens ar...

SUSE CVE-2026-33505

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in...

CVE-2026-33506

Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting XSS vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter callbackUrl,...

CVE-2026-33495

ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Ory Oathkeeper is often deployed behind other components like CDNs, WAFs, or reverse proxies. Depending on the setup, another component might forward the...

CVE-2026-33505

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in...

CVE-2026-33503

Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the ListCourierMessages Admin API in Ory Kratos is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configur...

GO-2026-4861 Hydra has Reflected XSS via error_hint parameter in github.com/ory/hydra

Hydra has Reflected XSS via errorhint parameter in github.com/ory/hydra. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

CVE-2026-33506

Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting XSS vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter callbackUrl,...

CVE-2026-33505

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in...

CVE-2026-33506 DOM-Based XSS in Ory Polis Login Page

Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based Cross-Site Scripting XSS vulnerability in Ory Polis's login functionality. The application improperly trusts a URL parameter callbackUrl,...