54145 matches found
CVE-2026-79671
Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...
CVE-2026-79671 Ech0 before 4.4.3 SSRF via DNS Resolution Bypass
Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...
CVE-2026-79659
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata...
EUVD-2026-65455
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata...
CVE-2026-79652
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
CVE-2026-79652 Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
CVE-2026-79652
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
EUVD-2026-65465
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
CVE-2026-79652
A flaw in the JWT Bearer authorization grant within the keycloak-services component of Red Hat Build of Keycloak fails to verify whether a client requires user consent before issuing an access token. An authenticated attacker with valid client credentials and a trusted identity provider assertion...
BIT-KEYCLOAK-2026-18963 Flaw in the reset-credentials flow of the keycloak-services component
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
Keycloak: Auth Bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
Improper Hostname Validation
org.keycloak, keycloak-services is vulnerable to improper hostname validation. The vulnerability is due to improper validation of wildcard domain suffixes, which allows an attacker who controls the reverse DNS of their connection to bypass host-based restrictions and perform unauthorized client...
Improper Authorization
keycloak-services is vulnerable to an improper authorization. The vulnerability is due to insufficient permission checks when a restricted administrator lists users assigned to a role, which allows an attacker with limited administrative privileges to exploit the role-users endpoint and access...
CVE-2026-79652: Missing Authorization
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
PT-2026-81265
Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the JWT Bearer authorization grant implementation within the keycloak-services component, which manages OAuth2 and OpenID Connect grant types for access tok...
VulnCheck KEV: CVE-2026-18963
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2024-34459...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a heap overflow in NLnet Labs Unbound [CVE-2026-42944]
Summary IBM Watson Speech Services Cartridge is vulnerable to a heap overflow in NLnet Labs Unbound, due to an issue that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet CVE-2026-42944. NLnet Labs Unbound is used as part ...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to improper encoding in Apache Log4j [CVE-2026-49844]
Summary IBM Watson Speech Services Cartridge is vulnerable to Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API, which produces output that is not valid JSON CVE-2026-49844. Apache Log4j is included in our speech microservices. This...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in PostgreSQL [CVE-2026-6473]
Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in PostgreSQL, due to an Integer wraparound in multiple server features which can allow an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds CVE-2026-6473. PostgreSQL is used as par...