Export limit exceeded: 12013 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,013

Export CSV
CVE-2026-94213

Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-94215

Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. Successful exploitation could lead to the exposure of client credentials or the redirection of administrative login attempts to malicious sites.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-94217

Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-94218

Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-105891

WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Liquid Web / Stellarwp Wordpress-extensions
Products
Event Tickets Event Tickets
CVE-2026-58279

Azure CycleCloud Elevation of Privilege Vulnerability

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Cyclecloud
CVE-2026-89128

Broken Access Control in SAP NetWeaver AS Java (Process Integration Test Tool)

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109808

Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI)

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must have prior knowledge of specific internal identifiers to successfully target the affected functionality. Successful exploitation could allow the attacker to read sensitive information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109809

Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit)

SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on integrity, with no impact on confidentiality and availability of the application.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125297

AsiaInfo Business Support System (BSS) Missing Authentication

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126123

BeeS ERP administrative console IDOR

BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-121031

chromium-browser: Missing authorization in PDF

Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-124431

Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all volumes, though not file contents.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Craft Cms
CVE-2026-124486

OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124478

OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124456

OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/list_report.php to view all patients' names, MRNs, insurance and prior-auth data, or submit arbitrary id values to public/index.php to overwrite other patients' prior-authorization records.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-82902

Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Ofbiz Apache Ofbiz
CVE-2026-82904

Apache OFBiz: Unbounded multi-form row count from a parameter name

Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Ofbiz Apache Ofbiz
CVE-2026-82916

Apache OFBiz: webtools xmldsdump exports any entity to any path

Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITY_MAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Ofbiz Apache Ofbiz