Export limit exceeded: 420915 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420915 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-0053 | 1 Google | 1 Android | 2026-11-06 | 8.4 High |
| In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android users. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-15943 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-11-06 | 5.5 Medium |
| A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret. | ||||
| CVE-2026-12388 | 1 Redhat | 2 Build Keycloak, Build Of Keycloak | 2026-11-06 | 6.5 Medium |
| A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role" mapper that assigns high-level administrative roles (like realm-admin) to themselves or others. This allows a restricted administrator to bypass security checks and gain full control over the entire realm. | ||||
| CVE-2026-28588 | 1 Google | 1 Android | 2026-11-06 | 8.4 High |
| In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-97848 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-11-06 | 6.5 Medium |
| A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources. | ||||
| CVE-2026-96547 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-11-06 | 6.5 Medium |
| A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens. | ||||
| CVE-2026-93579 | 2 Io.netty, Redhat | 23 Netty-codec-http2, Amq Broker, Apicurio Registry and 20 more | 2026-11-06 | 6.5 Medium |
| A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses. | ||||
| CVE-2026-18217 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-11-06 | 3.4 Low |
| A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account. | ||||
| CVE-2026-93492 | 2 Io.netty, Redhat | 24 Netty-codec-http2, Amq Broker, Amq Broker 7 and 21 more | 2026-11-06 | 5.3 Medium |
| A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS). | ||||
| CVE-2026-28597 | 1 Google | 1 Android | 2026-11-06 | 8.4 High |
| In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-114553 | 1 Drupal | 1 Frontend Editing | 2026-11-06 | 5.4 Medium |
| Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3. | ||||
| CVE-2026-107260 | 1 Drupal | 1 Sector Distribution | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2. | ||||
| CVE-2026-114531 | 1 Drupal | 1 Swiper Formatter | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0. | ||||
| CVE-2026-114530 | 1 Drupal | 1 Dopup | 2026-11-06 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7. | ||||
| CVE-2026-114529 | 1 Drupal | 1 Csv Field | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7. | ||||
| CVE-2026-114524 | 1 Drupal | 1 Custom Formatters | 2026-11-06 | 7.2 High |
| Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1. | ||||
| CVE-2026-114525 | 1 Drupal | 1 Abc | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1. | ||||
| CVE-2026-114526 | 1 Drupal | 1 Black Hole | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1. | ||||
| CVE-2026-114528 | 1 Drupal | 1 Zero Point | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1. | ||||
| CVE-2026-114527 | 1 Drupal | 1 Ui Icons | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2. | ||||