Keycloak < 26.2.9 Multiple Vulnerabilities (GHSA-wc64-wmfm-46vw)(GHSA-xmcw-mv9p-7pq2)

The version of Keycloak installed on the remote host is prior to 26.2.9. It is, therefore, affected by multiple vulnerabilities as reference in the advisory GHSA-wc64-wmfm-46vw and GHSA-xmcw-mv9p-7pq2. - A path traversal validation flaw exists in Keycloak’s vault key handling on Windows. The...

PT-2025-39231

Yes, Zoho has faced several security issues: - 2021: ManageEngine ADSelfService Plus vulnerability CVE-2021-40539 exploited by APT27, affecting 9+ organizations and 11,000+ servers with Godzilla Webshell malware. Patched by Zoho. - 2022: Critical RCE flaw in ManageEngine led to BankingLab breach,...

No title provided

A path traversal validation flaw exists in Keycloak’s vault key handling on Windows. The previous fix for CVE-2024-10492 did not account for the Windows file separator . As a result, a high-privilege administrator could probe for the existence of files outside the expected realm context through...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: rancher-machine, cloud-provider-aws, newrelic-fluent-bit-output, dagdotdev, git-lfs, vexctl, hivemind, blobfuse2, mongodb-kubernetes-operator, kube-vip-cloud-provider, pvc-autoresizer, php-fpmexporter, gostatsd, container-object-storage-interface, kube-vip,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: rancher-machine, cloud-provider-aws, newrelic-fluent-bit-output, dagdotdev, git-lfs, vexctl, hivemind, blobfuse2, mongodb-kubernetes-operator, kube-vip-cloud-provider, pvc-autoresizer, php-fpmexporter, gostatsd, container-object-storage-interface, kube-vip,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: yace-fips, k8sgpt-operator, vault-k8s, nvidia-nsight-compute-12.8, pvc-autoresizer, kserve-rest-proxy, shfmt, docker-credential-ecr-login, git-lfs, gitsign, nemo, nvidia-nsight-compute-13.2, knative-serving, kube-vip-cloud-provider, php-fpmexporter, karpenter,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: yace-fips, k8sgpt-operator, vault-k8s, nvidia-nsight-compute-12.8, pvc-autoresizer, kserve-rest-proxy, shfmt, docker-credential-ecr-login, git-lfs, gitsign, nemo, nvidia-nsight-compute-13.2, knative-serving, kube-vip-cloud-provider, php-fpmexporter, karpenter,...

PT-2025-38403

Name of the Vulnerable Software and Affected Versions Vault affected versions not specified Chrome affected versions not specified Description The reported issue concerns authentication flaws within AWS and a denial-of-service condition related to JSON processing in Vault. Additionally, a...

SUSE CVE-2025-6203

A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault's auditing subroutine, potentially resulting in the Vault server to become...

GO-2025-3924 HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault

HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault...

PT-2025-36648

HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault...

GHSA-RCW7-PQFP-735X secrets-store-sync-controller discloses service account tokens in logs

Hello Kubernetes Community, A security issue was discovered in secrets-store-sync-controller where an actor with access to the controller logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vau...

CVE-2025-10043

Rejected reason: Considered by the maintainers a bug scenario experienced rather than a vulnerability...

CVE-2025-10043

...

CVE-2025-10043

...

CVE-2025-10043

CVE-2025-10043 is rejected/not used as stated; not an active vulnerability entry.

External Control of File Name or Path

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to External Control of File Name or Path due to the vault secret lookup not accounting for the Windows file...

PT-2025-36326

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A path traversal flaw exists in Keycloak’s vault key handling on Windows. A previous fix for a related issue did not account for the Windows file separator , allowing a high-privilege...

PT-2025-36631

Hello Kubernetes Community, A security issue was discovered in secrets-store-sync-controller where an actor with access to the controller logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vau...

CVE-2025-9695

A vulnerability was identified in GalleryVault Gallery Vault App up to 4.5.2 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.thinkyeah.galleryvault. The manipulation leads to improper export of android application components. T...