Export limit exceeded: 42167 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (42167 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79652 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-09-16 | 5.9 Medium |
| A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client. | ||||
| CVE-2026-18573 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid 8 and 5 more | 2026-09-16 | 6.5 Medium |
| A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper evaluation of the client state during an update operation, an attacker with client management permissions can bypass these security policies by first creating a public client and then updating it to a confidential client with weaker authentication. This can result in the persistence of clients that do not comply with the intended security hardening of the realm. | ||||
| CVE-2026-18572 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-09-16 | 6.5 Medium |
| Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times. | ||||
| CVE-2026-18571 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-09-16 | 6.6 Medium |
| A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users. | ||||
| CVE-2026-18570 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-09-16 | 5.4 Medium |
| A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows the client to obtain tokens with unauthorized role mappings. | ||||
| CVE-2026-18218 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-09-16 | 4.2 Medium |
| A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | ||||
| CVE-2026-18214 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-09-16 | 6.8 Medium |
| Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm. | ||||
| CVE-2026-18201 | 1 Redhat | 7 Build Keycloak, Build Of Keycloak, Data Grid and 4 more | 2026-09-16 | 5.5 Medium |
| Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations. | ||||
| CVE-2026-16106 | 1 Redhat | 7 Build Keycloak, Build Of Keycloak, Data Grid and 4 more | 2026-09-16 | 4.9 Medium |
| A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage, leading to a loss of access for other users and administrators. | ||||
| CVE-2026-16105 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-09-16 | 4.9 Medium |
| A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm. | ||||
| CVE-2026-73477 | 2 Drupal, Quick Tabs Project | 2 Quick Tabs, Quick Tabs | 2026-09-16 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1. | ||||
| CVE-2026-46460 | 1 Dell | 1 Powerscale Onefs | 2026-09-16 | 3.5 Low |
| Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized modification of system logs. | ||||
| CVE-2026-87075 | 1 Tanium | 1 Comply | 2026-09-16 | 8.1 High |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-87073 | 1 Tanium | 1 Comply | 2026-09-16 | 6.5 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-87072 | 1 Tanium | 1 Comply | 2026-09-16 | 7.1 High |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-87048 | 1 Tanium | 1 Comply | 2026-09-16 | 5.4 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-87046 | 1 Tanium | 1 Comply | 2026-09-16 | 4.3 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-87037 | 1 Tanium | 1 Comply | 2026-09-16 | 5.4 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-87036 | 1 Tanium | 1 Comply | 2026-09-16 | 8.1 High |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-61910 | 2 Cyrus, Cyrusimap | 2 Imap, Cyrus Imap | 2026-09-16 | 3.5 Low |
| An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.) | ||||