Export limit exceeded: 420280 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420280 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420280 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123290 | 2026-11-06 | 5.3 Medium | ||
| In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint | ||||
| CVE-2026-123289 | 2026-11-06 | 5.4 Medium | ||
| In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files | ||||
| CVE-2026-123288 | 2026-11-06 | 5.4 Medium | ||
| In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link | ||||
| CVE-2026-123287 | 2026-11-06 | 5.9 Medium | ||
| In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports | ||||
| CVE-2026-123286 | 2026-11-06 | 5.9 Medium | ||
| In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token | ||||
| CVE-2026-123285 | 2026-11-06 | 6.3 Medium | ||
| In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection | ||||
| CVE-2026-123284 | 2026-11-06 | 6.5 Medium | ||
| In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content | ||||
| CVE-2026-97846 | 1 Redhat | 4 Build Keycloak, Build Of Keycloak, Red Hat Single Sign On and 1 more | 2026-11-06 | 6.8 Medium |
| Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections. | ||||
| CVE-2026-123283 | 2026-11-06 | 6.8 Medium | ||
| In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account | ||||
| CVE-2026-123282 | 2026-11-06 | 7.4 High | ||
| In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session | ||||
| CVE-2026-97367 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-11-06 | 6.4 Medium |
| A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password. | ||||
| CVE-2026-123281 | 2026-11-06 | 7.5 High | ||
| In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker | ||||
| CVE-2026-123280 | 2026-11-06 | 8.1 High | ||
| In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports | ||||
| CVE-2026-123279 | 2026-11-06 | 9 Critical | ||
| In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators | ||||
| CVE-2026-123278 | 2026-11-06 | 6.7 Medium | ||
| In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint | ||||
| CVE-2026-123277 | 2026-11-06 | 5 Medium | ||
| In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux | ||||
| CVE-2026-123276 | 2026-11-06 | 7.8 High | ||
| In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile | ||||
| CVE-2026-97311 | 1 Redhat | 4 Build Keycloak, Build Of Keycloak, Red Hat Single Sign On and 1 more | 2026-11-06 | 4.3 Medium |
| A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups. | ||||
| CVE-2026-97177 | 1 Redhat | 4 Build Keycloak, Build Of Keycloak, Red Hat Single Sign On and 1 more | 2026-11-06 | 6.6 Medium |
| A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account. | ||||
| CVE-2026-96547 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-11-06 | 6.5 Medium |
| A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens. | ||||