Browse All CVEs
50,472 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-94257 |
high | 8.1 | 0.0023 | 2026-11-06 | The SMS Alert WordPress plugin before 4.0.3 does not bind the account whose password is be | |
CVE-2026-84164 |
none | — | 0.0027 | 2026-11-06 | The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd di | |
CVE-2025-52970 |
high | 8.1 | 0.0932 | 2026-11-06 | 3 PoC | A improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, |
CVE-2026-84161 |
medium | 4.9 | 0.0031 | 2026-11-06 | When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STOR | |
CVE-2026-66295 |
low | 2.1 | 0.0017 | 2026-11-06 | Saxy's XML encoder writes the target and the content of a processing instruction into the | |
CVE-2026-66294 |
low | 2.1 | 0.0017 | 2026-11-06 | XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characte | |
CVE-2026-66293 |
low | 2.1 | 0.0017 | 2026-11-06 | XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in | |
CVE-2026-116630 |
medium | 5.9 | 0.0015 | 2026-11-06 | undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8 | |
CVE-2026-93565 |
high | 7.5 | 0.0086 | 2026-11-06 | A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly st | |
CVE-2026-93564 |
high | 7.5 | 0.0106 | 2026-11-06 | A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder | |
CVE-2026-93558 |
high | 7.5 | 0.0122 | 2026-11-06 | A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated att | |
CVE-2026-93491 |
high | 7.5 | 0.0088 | 2026-11-06 | A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploi | |
CVE-2026-93488 |
high | 7.5 | 0.0095 | 2026-11-06 | A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent re | |
CVE-2026-97846 |
medium | 6.8 | 0.0016 | 2026-11-06 | Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token c | |
CVE-2026-97311 |
medium | 4.3 | 0.0028 | 2026-11-06 | A flaw was found in the Admin REST API of Keycloak, an identity and access management solu | |
CVE-2026-97177 |
medium | 6.6 | 0.0028 | 2026-11-06 | A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Gr | |
CVE-2026-96448 |
medium | 6.6 | 0.0028 | 2026-11-06 | A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an i | |
CVE-2026-96446 |
medium | 4.2 | 0.0034 | 2026-11-06 | A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The i | |
CVE-2026-96445 |
medium | 6.8 | 0.0046 | 2026-11-06 | A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access | |
CVE-2026-95503 |
medium | 6.8 | 0.0021 | 2026-11-06 | A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity | |
CVE-2026-94217 |
low | 3.5 | 0.0029 | 2026-11-06 | A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue oc | |
CVE-2026-94215 |
medium | 5.5 | 0.0036 | 2026-11-06 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access man | |
CVE-2026-94213 |
medium | 4.9 | 0.0044 | 2026-11-06 | A flaw was found in the Authorization Services component of Keycloak, an open-source ident | |
CVE-2026-94001 |
medium | 6.5 | 0.0056 | 2026-11-06 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access man | |
CVE-2026-94000 |
medium | 6.6 | 0.0049 | 2026-11-06 | 1 PoC | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access man |
CVE-2026-93999 |
medium | 4.2 | 0.0029 | 2026-11-06 | A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity | |
CVE-2026-93566 |
medium | 6.5 | 0.0058 | 2026-11-06 | A flaw was found in Netty. A remote attacker could exploit this by sending a specially cra | |
CVE-2026-93562 |
medium | 6.5 | 0.0049 | 2026-11-06 | A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-En | |
CVE-2026-89298 |
medium | 4.9 | 0.0047 | 2026-11-06 | A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source id | |
CVE-2026-88770 |
medium | 6.5 | 0.0040 | 2026-11-06 | A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and acces | |
CVE-2026-82968 |
medium | 6.4 | 0.0032 | 2026-11-06 | A flaw was found in the first-broker-login flow of the Keycloak identity management servic | |
CVE-2026-19608 |
medium | 5.3 | 0.0034 | 2026-11-06 | A flaw was found in the group policy provider of Keycloak authorization services, which is | |
CVE-2026-18217 |
medium | 4.7 | 0.0052 | 2026-11-06 | A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity | |
CVE-2026-18208 |
medium | 6.5 | 0.0041 | 2026-11-06 | A flaw was found in the OIDC token introspection endpoint of the keycloak-services compone | |
CVE-2026-18207 |
medium | 6.5 | 0.0039 | 2026-11-06 | A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs | |
CVE-2026-18203 |
medium | 6.5 | 0.0039 | 2026-11-06 | A flaw was found in the group policy evaluation logic of Keycloak, an identity and access | |
CVE-2026-16103 |
medium | 4.3 | 0.0044 | 2026-11-06 | A flaw was found in the keycloak-services component of Keycloak. This issue is an incomple | |
CVE-2026-15943 |
medium | 5.5 | 0.0042 | 2026-11-06 | A flaw was found in the Keycloak keycloak-services component, which handles the management | |
CVE-2026-12388 |
medium | 6.5 | 0.0047 | 2026-11-06 | A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is use | |
CVE-2026-107623 |
medium | 4.3 | 0.0020 | 2026-11-06 | A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bu | |
CVE-2026-107121 |
medium | 6.5 | 0.0011 | 2026-11-06 | A flaw was found in the SMTP email configuration handling of the keycloak-services compone | |
CVE-2026-105305 |
medium | 5.4 | 0.0023 | 2026-11-06 | A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Au | |
CVE-2026-101333 |
low | 3.7 | 0.0028 | 2026-11-06 | A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for | |
CVE-2026-84155 |
medium | 5.3 | 0.0014 | 2026-11-06 | CodeChecker's web server fails to fully invalidate a session token on logout when the serv | |
CVE-2026-123337 |
low | 3.1 | 0.0020 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19656 users without update permission could change iss | |
CVE-2026-123336 |
low | 3.1 | 0.0076 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via | |
CVE-2026-123335 |
low | 3.5 | 0.0018 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authoriza | |
CVE-2026-123334 |
low | 3.8 | 0.0024 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete | |
CVE-2026-123333 |
low | 3.8 | 0.0020 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inacc | |
CVE-2026-123332 |
medium | 4.7 | 0.0022 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to m |