CVE Vulnerability Catalog

A vulnerability in Symfony UX allows an authenticated client to send a single _batch request with thousands of actions, exhausting server resources (CPU, memory, database connections) due to unbounded iteration over the actions array.

A vulnerability in Symfony UX allows an attacker to manipulate dates by sending relative strings (e.g., now, tomorrow, +10 years) to a LiveProp of type DateTimeInterface without a configured format. This bypasses time-based business logic checks.

In pyzipper prior to version 0.4.0, a Python operator precedence bug in pyzipper/zipfile_aes.py caused the AE-2 format to never be automatically selected during encryption, forcing the use of AE-1 format. This exposed the plaintext CRC32 checksum in the ZIP header and, for unseekable archives, in the datadescripter section, allowing an attacker with access to the archive to brute-force candidate plaintexts for small or low-entropy files by comparing CRC32 values.

CVE-2026-21761 in HCL DevOps Loop is caused by a misconfigured Cross-Origin Resource Sharing (CORS) policy. This flaw may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.

A flaw in Keycloak's default-groups REST endpoint and realm representation allows a delegated administrator with realm-viewing permissions to see names and identifiers of hidden default groups, even without specific permissions to view those groups.

A missing authorization check in Keycloak's admin REST API allows a delegated administrator to remove privileged child roles from composite roles without proper permissions. This can result in loss of access for other users and administrators.

A flaw was found in the keycloak-services component, the core engine of Red Hat Build of Keycloak, where sensitive configuration values such as reCAPTCHA secret keys are not masked when requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.

In Keycloak, an incomplete fix for CVE-2026-9798 was found. Brute-force protection was added to the CIBA initiation handler but omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a locked user account if the authentication request was started before the lockout and approved by the user.

A flaw in Keycloak's Client Policies mechanism allows bypassing the requirement for signed JWT assertions. An attacker with valid client credentials can provide a fake, unsigned assertion header, tricking the system into thinking policy requirements are met.

An authorization bypass vulnerability in GisLab Laboratory Management System allows exploitation of user-controlled keys. This flaw enables attackers to misuse trusted identifiers, potentially gaining unauthorized access.

The vulnerability in Mojo::JWT for Perl before version 1.02 is that HMAC signature verification uses a non-constant-time string comparison. The decode() method uses Perl's eq operator, which compares bytes until the first differing one, causing variable response time depending on the number of matching leading bytes.

A missing authorization vulnerability in Maybe through version 0.6.0 allows authenticated low-privilege member-role users to access and modify global hosting settings. The Settings::HostingsController lacks proper access controls, exposing the operator's Synth API key in plaintext and allowing attackers to overwrite it, toggle public registration, and disable email confirmation.

TheHive through version 4.1.24 has a broken object-level authorization vulnerability in attachment download endpoints, allowing any authenticated user to access attachments from other organizations by supplying a content-hash identifier. The missing organization-scoped check in AttachmentSrv.visible enables attackers to download arbitrary attachments.

TheHive up to version 4.1.24 contains an unauthenticated information disclosure vulnerability that allows attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint. The StatusCtrl.scala handler lacks authentication enforcement, exposing the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles.

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint. It allows authenticated local users to access post-leave room state events by exploiting a flawed membership check.

Dendrite up to version 0.13.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers can exploit distinguishable error response classes and leaked internal IP addresses in error messages to perform blind port scanning and enumerate internal network topology.

Dendrite through version 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users. Attackers can exploit the unverified Forget3PID handler to remove a victim's email or MSISDN binding and subsequently rebind the address through an identity server to hijack the victim's password reset flow.

The Joomla extension Events Booking before version 5.8.0 is vulnerable to unauthenticated user enumeration, allowing retrieval of usernames and email addresses.

A missing authorization vulnerability in GitHub Enterprise Server allowed an authenticated user with write access to any repository to read metadata from private repositories they did not have access to. The flaw enabled enumeration of rule identifiers and disclosure of repository names, branch names, commit SHAs, commit messages, and the pushing actor.