Export limit exceeded: 420299 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420299 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123330 | 2026-11-06 | 5.4 Medium | ||
| In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings | ||||
| CVE-2026-123329 | 2026-11-06 | 5.4 Medium | ||
| In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions | ||||
| CVE-2026-123327 | 2026-11-06 | 7.5 High | ||
| In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions | ||||
| CVE-2026-105305 | 1 Redhat | 4 Build Keycloak, Build Of Keycloak, Red Hat Single Sign On and 1 more | 2026-11-06 | 5.4 Medium |
| A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API. | ||||
| CVE-2026-123326 | 2026-11-06 | 7.1 High | ||
| In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension | ||||
| CVE-2026-123323 | 2026-11-06 | 8.4 High | ||
| In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation | ||||
| CVE-2026-123320 | 2026-11-06 | 3.1 Low | ||
| In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server | ||||
| CVE-2026-103884 | 1 Redhat | 4 Build Keycloak, Build Of Keycloak, Red Hat Single Sign On and 1 more | 2026-11-06 | 6.5 Medium |
| A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash. | ||||
| CVE-2026-123315 | 2026-11-06 | 7 High | ||
| In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option | ||||
| CVE-2026-123312 | 2026-11-06 | 3.3 Low | ||
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing | ||||
| CVE-2026-123309 | 2026-11-06 | 6.1 Medium | ||
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview | ||||
| CVE-2026-101333 | 1 Redhat | 4 Build Keycloak, Build Of Keycloak, Red Hat Single Sign On and 1 more | 2026-11-06 | 3.7 Low |
| A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series. This can lead to excessive memory consumption and degrade the performance of both the server and its monitoring tools. | ||||
| CVE-2026-123308 | 2026-11-06 | 6.3 Medium | ||
| In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects | ||||
| CVE-2026-123300 | 2026-11-06 | 2.7 Low | ||
| In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings | ||||
| CVE-2026-123294 | 2026-11-06 | 9.6 Critical | ||
| In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow | ||||
| CVE-2026-97848 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-11-06 | 6.5 Medium |
| A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources. | ||||
| CVE-2026-97846 | 1 Redhat | 4 Build Keycloak, Build Of Keycloak, Red Hat Single Sign On and 1 more | 2026-11-06 | 6.8 Medium |
| Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections. | ||||
| CVE-2026-97367 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-11-06 | 6.4 Medium |
| A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password. | ||||
| CVE-2026-123278 | 2026-11-06 | 6.7 Medium | ||
| In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint | ||||
| CVE-2026-123277 | 2026-11-06 | 5 Medium | ||
| In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux | ||||