Rezultati pretraživanja za 'Proizvođač: redhat'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-9791 | 4.3 | A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This | 2026-06-26 02:16:55 | 2026-05-28 05:16:39 |
| CVE-2026-9704 | 6.8 | A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently drop | 2026-06-26 02:16:55 | 2026-05-27 14:17:40 |
| CVE-2026-9087 | 6.4 | A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get lin | 2026-06-26 02:16:55 | 2026-05-20 17:16:32 |
| CVE-2026-8922 | 5.4 | A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should | 2026-06-26 02:16:54 | 2026-05-19 08:16:18 |
| CVE-2026-8830 | 4.3 | A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly cr | 2026-06-26 02:16:54 | 2026-05-19 07:16:30 |
| CVE-2026-7500 | 5.4 | When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — | 2026-06-26 02:16:54 | 2026-04-30 15:16:23 |
| CVE-2026-4874 | 3.1 | A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `bac | 2026-06-26 02:16:53 | 2026-03-26 08:16:22 |
| CVE-2026-37977 | 3.7 | A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the `azp` claim from a client-supplied | 2026-06-26 02:16:52 | 2026-04-06 09:16:17 |
| CVE-2023-46850 | 9.8 | Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer. | 2026-06-23 22:16:30 | 2023-11-11 01:15:07 |
| CVE-2023-6879 | 9.0 | Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). | 2026-06-23 18:17:38 | 2023-12-27 23:15:07 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/904
Zapisa po stranici: