11637 matches found
keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability
A flaw was found in Keycloak. An authenticated administrator with the manage-clients role can exploit a Time-of-check to time-of-use TOCTOU vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to realm-admin for all users within the realm,...
EUVD-2026-61214
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...
CVE-2026-67442
FUXA (web-based SCADA/HMI/Dashboard) prior to 1.3.3 has a business-logic flaw in the DELETE /api/roles endpoint. When a role is deleted, the role identifier is not removed from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifi...
CVE-2026-67442 FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...
CVE-2026-67442 FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...
CVE-2026-55163
Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermissionroleid, which allowed either an administrator or any existing member of the target role. The handler passed data"users" and data"name" to service.updat...
CVE-2026-55163 Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership
Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermissionroleid, which allowed either an administrator or any existing member of the target role. The handler passed data"users" and data"name" to service.updat...
CVE-2026-55163 Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership
Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermissionroleid, which allowed either an administrator or any existing member of the target role. The handler passed data"users" and data"name" to service.updat...
CVE-2026-66780
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...
CVE-2026-48508
Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...
CVE-2026-48508 Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission
Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...
EUVD-2026-61100
Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...
CVE-2026-48508 Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission
Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...
CVE-2026-66780
Submariner-operator contains a flaw where the submariner-k8s-broker-cluster Role, assigned to joined clusters, holds excessive permissions. A compromised cluster can overwrite other clusters' endpoint information, redirecting inter-cluster tunnel traffic and enabling a Man-in-the-Middle (MITM) at...
CVE-2026-66780 Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...
CVE-2026-19869
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...
WordPress KiviCare plugin < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability
Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability discovered by Mokksh Parekh in WordPress Plugin KiviCare versions 4.5.2...
CVE-2026-19869
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...
CVE-2026-71365
AWX's webhook status callback mechanism extracts the statuses_url from GitHub pull request payloads without validating the target host. An admin-role user can forge a signed webhook with an arbitrary URL, causing AWX to POST authenticated status updates with the Git PAT in the Authorization heade...