120002 matches found
EUVD-2026-65521
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...
CVE-2026-69104
JFrog Artifactory (self-managed) is affected by an insufficient permission enforcement flaw in repository migration operations . An authenticated user with low privileges can initiate migration operations on repositories for which they lack the required permissions, potentially leading to informa...
CVE-2026-55530
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58 , the ast_grep_rewrite tool lacks the @require_approval decorator enforced on sibling mutation tools. With dry_run=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the ...
Vulnerabilities are handled in GitLab through GitLab Inc.
GitLab Inc. has identified vulnerabilities in the GitLab Community Edition CE and Enterprise Edition EE. These vulnerabilities reside in the GraphQL implementation of GitLab. The first vulnerability allowed unauthorized users to perform unauthorized modifications or deletions on public projects a...
CVE-2026-41847
A flaw was found in Spring WebFlux applications. This vulnerability allows for a security bypass when using the Kotlin Router DSL. An attacker could exploit this to bypass security restrictions, potentially leading to unauthorized access. Mitigation This vulnerability only applies when using Kotl...
CVE-2026-48099
A flaw was found in WsgiDAV, a WebDAV server. A remote attacker could exploit this vulnerability by sending a specially crafted WebDAV request path containing encoded parent-directory segments. This could allow the attacker to escape the configured filesystem share root, potentially leading to...
CVE-2026-78581
CVE-2026-78581 is an authorization bypass (CWE-639) in Kibana affecting the AI Assistant feature. An authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-g...
grafana security, bug fix, and enhancement update
An update is available for grafana. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...
BIT-KEYCLOAK-2026-4636 Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.
A flaw was found in Keycloak. An authenticated user with the umaprotection role can bypass User-Managed Access UMA policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned...
BIT-KEYCLOAK-2026-4325 Keycloak: keycloak: replay of action tokens via improper handling of single-use entries
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This...
BIT-KEYCLOAK-2026-3047 Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language SAML client is configured as an Identity Provider IdP-initiated broker landing target, it can still complete the login process and establish a Single Sign-On SSO session. This allows a remote attacker...
BIT-KEYCLOAK-2026-2603 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider
A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...
BIT-KEYCLOAK-2026-2092 Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. Thi...
BIT-KEYCLOAK-2026-1609 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
A flaw was found in Keycloak. When the JSON Web Token JWT authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper...
EUVD-2026-65465
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
CVE-2026-77142
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...
CVE-2026-77141
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activa...
CVE-2026-77142
CVE-2026-77142 is a Broken Access Control vulnerability in the TYPO3 extension Industry Directory (yellowpages2) . The frontend self-service editing feature hides the edit form using a template-level visibility flag for company records a visitor does not own, but the corresponding server-side wri...
CVE-2026-17548 Missing authorization for viewing background jobs
Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...