3799 matches found
MINI-Q7PC-WQQV-RPMQ
Bulletin has no description...
CVE-2026-73513
No description is available for this CVE...
CVE-2026-80221
No description is available for this CVE...
CVE-2026-77849
No description is available for this CVE...
MINI-874X-5946-W4P7
Bulletin has no description...
MINI-8FJQ-4VXG-93P6
Bulletin has no description...
MINI-58JX-J435-9HF2
Bulletin has no description...
MINI-HCPR-6RHJ-7MMH
Bulletin has no description...
MINI-CVF4-59MW-8JW6
Bulletin has no description...
MINI-F82C-XVWV-QP97
Bulletin has no description...
MINI-4CP9-CFF8-QGRG
Bulletin has no description...
MINI-4WM2-PWCQ-6RGQ
Bulletin has no description...
MINI-R658-WF9F-8V9W
Bulletin has no description...
MINI-43PJ-9QVQ-HHR5
Bulletin has no description...
ECHO-81E4-B1FC-A9F9
Bulletin has no description...
ECHO-0EC6-0396-A56F
Bulletin has no description...
ECHO-6E54-DE1B-08C9
Bulletin has no description...
ECHO-73AB-600D-62BE Caught by Cursor Bugbot review on PR #19827: the real vulnerability (GHSA-7xf9-4jfc-wgm4) is specific to Fine-Grained Admin Permissions V2's RealmPermissionsV2 treating manage-clients as equivalent to managing the special "admin-permissions" client, which then grants realm-wide admin power. RealmPermissionsV2 and the admin-permissions client concept do not exist in 25.0.6 — its older RealmPermissions.canManageAuthorizationDefault() has no per-ResourceServer parameter at all (it's a single, undifferentiated realm-wide check), so there is no "is this the special admin-permissions client" distinction for a narrow, upstream-faithful fix to attach to. An earlier patch here unconditionally removed MANAGE_CLIENTS from that check to close the described escalation, but that changes intended authorization behavior for every regular client's authorization management, not just a vulnerable path (upstream's real fix leaves the MANAGE_CLIENTS grant intact for non-admin-permissions clients) — reverted.
Bulletin has no description...