Lucene search
+L

108757 matches found

RedHat Linux
RedHat Linux
added 2026/06/25 6:47 p.m.20 views

keycloak: Keycloak: Information disclosure through arbitrary filesystem path probing

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining...

4.9CVSS5.9AI score0.00519EPSS
SaveExploits0References4
OSV
OSV
added 2026/06/25 6:43 p.m.9 views

GO-2026-5292 Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter in github.com/getarcaneapp/arcane/backend

Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter in github.com/getarcaneapp/arcane/backend...

6.3CVSS5.8AI score0.0021EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/25 6:43 p.m.11 views

GO-2026-5388 Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback in github.com/nhost/nhost

Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback in github.com/nhost/nhost...

7.5CVSS5.8AI score0.00267EPSS
SaveExploits1References3
OSV
OSV
added 2026/06/25 6:43 p.m.8 views

GO-2026-5272 Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline

Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline...

8.5CVSS5.2AI score0.00788EPSS
SaveExploits1References2
OSV
OSV
added 2026/06/25 6:26 p.m.10 views

GO-2026-5113 ShellHub has crash-DoS via field injection in filter and sort-by parameters in github.com/shellhub-io/shellhub

ShellHub has crash-DoS via field injection in filter and sort-by parameters in github.com/shellhub-io/shellhub...

5.4CVSS5.8AI score0.00253EPSS
SaveExploits1References2
OSV
OSV
added 2026/06/25 6:26 p.m.10 views

GO-2026-5164 CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns

CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns...

8.7CVSS5.8AI score0.00672EPSS
SaveExploits1References3
OSV
OSV
added 2026/06/25 6:26 p.m.9 views

GO-2026-5141 Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel

Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel...

3.5CVSS5.8AI score0.00219EPSS
SaveExploits1References3
Cvelist
Cvelist
added 2026/06/25 6:14 p.m.40 views

CVE-2026-56790 CANBoat - Off-by-One Global Buffer Overflow in searchForPgn()

CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overflow in the searchForPgn function in analyzer/pgn.c that allows remote attackers to crash the application. Attackers can deliver a crafted NMEA-2000 message with an out-of-range PGN value over CAN bus or...

7.3CVSS0.00215EPSS
SaveExploits0References4
OSV
OSV
added 2026/06/25 6:11 p.m.9 views

CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

5.3CVSS6AI score
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/06/25 5:36 p.m.13 views

keycloak: Keycloak: Information disclosure through arbitrary filesystem path probing

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining...

4.9CVSS5.9AI score0.00519EPSS
SaveExploits0References4
NVD
NVD
added 2026/06/25 5:17 p.m.17 views

CVE-2026-9083

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining...

4.9CVSS0.00519EPSS
SaveExploits0References6
NVD
NVD
added 2026/06/25 5:16 p.m.14 views

CVE-2026-54030

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata RFC 9728 matches the configured MCP server URL, allowing a malicious MCP server to...

9.3CVSS0.00129EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment
added 2026/06/25 4:17 p.m.11 views

CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining...

4.9CVSS5.9AI score0.00519EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/25 4:17 p.m.11 views

EUVD-2026-39476

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining...

4.9CVSS5.9AI score0.00519EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/06/25 4:17 p.m.13 views

CVE-2026-9083

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining...

4.9CVSS5.9AI score0.00519EPSS
SaveExploits0References7
CVE
CVE
added 2026/06/25 4:17 p.m.49 views

CVE-2026-9083

CVE-2026-9083 (Keycloak) : A flaw allows a realm administrator with the manage-realm role to submit an arbitrary filesystem path as a keystore parameter when creating a key provider component, enabling probing of arbitrary filesystem paths and disclosure of files readable by the Keycloak process....

4.9CVSS5.9AI score0.00519EPSS
SaveExploits0References6Affected Software1
Cvelist
Cvelist
added 2026/06/25 4:17 p.m.43 views

CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining...

4.9CVSS0.00519EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/06/25 4:16 p.m.57 views

CVE-2026-9800 Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...

8.1CVSS0.00358EPSS
SaveExploits0References8
RedhatCVE
RedhatCVE
added 2026/06/25 4:1 p.m.17 views

CVE-2026-9083

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining...

4.9CVSS5.9AI score0.00519EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/06/25 3:50 p.m.40 views

CVE-2026-45233 HTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosave

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences...

8.1CVSS0.00567EPSS
SaveExploits0References2
Rows per page
Query Builder