5675 matches found
EUVD-2026-53393
A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication skip-auth-regex, the proxy forwards client-supplied identity headers X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token to the upstream application without stripping them. An unauthenticated attacke...
EUVD-2026-53395
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...
keycloak-services: keycloak-services: SAML IdP-initiated broker login bypasses link-only restriction
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...
CVE-2026-16442
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...
osbuild-composer security, bug fix, and enhancement update
175-1.0.1 - Track github upstream...
EUVD-2026-50566
undici vulnerable to downstream response desynchronization via retry interceptor...
Oracle Linux 8 : kernel (ELSA-2026-47011)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47011 advisory. 4.18.0-553.148.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to t...
CVE-2026-17970
An insufficient validation of untrusted input flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=518814464...
CVE-2026-17961
An inappropriate implementation flaw was found in the Session component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517700791...
CVE-2026-17994
An inappropriate implementation flaw was found in the Media component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=520663771...
CVE-2026-17990
An insufficient validation of untrusted input flaw was found in the WebAuthn component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=520018012...
CVE-2026-17964
An incorrect security ui flaw was found in the UI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=518025103...
CVE-2026-18009
An insufficient validation of untrusted input flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522419718...
CVE-2026-18017
An use after free flaw was found in the Dawn component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523731236...
CVE-2026-17982
An insufficient validation of untrusted input flaw was found in the Cast component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=519735808...
CVE-2026-17957
An inappropriate implementation flaw was found in the CORS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517476342...
CVE-2026-17995
An out of bounds read flaw was found in the Dawn component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=520972775...
CVE-2026-17974
An insufficient policy enforcement flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=519232592...
UBUNTU-CVE-2026-16728
undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...