CVE Vulnerability Catalog

W Keycloak znaleziono lukę, która pozwala użytkownikowi o niskich uprawnieniach, znającemu dane logowania i identyfikator klienta, na obejście zabezpieczenia mającego na celu wyłączenie domyślnego przepływu w klientach OpenID Connect (OIDC). Manipulując danymi klienta podczas ponownego uruchamiania sesji, atakujący może uzyskać dostęp do tokena, który nie powinien być dostępny.

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker can pre-create an authentication session and trick a victim into clicking a malicious link, allowing the attacker to hijack the required-action form without the victim's credentials. Successful exploitation could lead to complete account takeover, including highly privileged administrative accounts.

A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited.

A flaw was found in Keycloak where a remote, unauthenticated attacker can send a specially crafted XML input to the SAML endpoint, causing high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) and server unavailability.

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation.

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server.

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the 'Date Menu of news articles' plugin.

Apache OFBiz has a vulnerability related to improper control of code generation and improper neutralization of directives in dynamically evaluated code. This issue affects versions before 24.09.06.

The Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz before version 24.09.06 allows an attacker to use the server to send requests to internal or external resources.

The CVE-2026-31909 vulnerability in Apache OFBiz involves exposure of sensitive information to unauthorized actors. This issue affects versions before 24.09.06.

The SSRF vulnerability in Apache OFBiz, occurring in Content component operations, allows an attacker to send malicious requests to the server. This issue affects versions of Apache OFBiz before 24.09.06.

In Samsung Open Source Escargot (commit 590345cc), an out-of-bounds write vulnerability exists that can lead to buffer overflows.

This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.

In Samsung Open Source Escargot (commit 590345cc), a heap-based buffer overflow vulnerability exists that can lead to buffer overflows.

In Samsung Open Source Escargot (commit 590345cc), a use-after-free vulnerability exists that allows pointer manipulation.

The Fortis for WooCommerce WordPress plugin before version 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retrieve sensitive customer information like past orders and PII.

OpenHarmony version 6.0 and earlier allows a remote attacker to execute arbitrary code in pre-installed apps.

OpenHarmony v6.0 and prior versions allow a local attacker to cause a denial of service (DoS) that makes the system unavailable and unrecoverable without intervention.

OpenHarmony version 6.0 and earlier allows a remote attacker to execute arbitrary code in pre-installed apps.

AutoGPT versions 0.6.34 through 0.6.51 deserialize Redis cache bytes using pickle.loads without integrity checks. An attacker who poisons a Redis key can achieve remote code execution in the backend container.