#severity:medium

共收录 5506 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. ...

CVE-2026-118947

A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core l

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-639 #severity:medium

漏洞预警2026-10-29 发布MEDIUM

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the ...

CVE-2026-119285

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory #cve #cwe-346 #cwe-942 #go #severity:medium

漏洞预警2026-10-29 发布MEDIUM

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result byt...

CVE-2026-119281

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-838 #maven #severity:medium

漏洞预警2026-10-29 发布MEDIUM

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength()...

CVE-2026-119279

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-130 #cwe-190 #maven #severity:medium

漏洞预警2026-10-29 发布MEDIUM

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was ne...

CVE-2026-119276

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-130 #cwe-789 #maven #severity:medium

漏洞预警2026-10-29 发布MEDIUM

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalF...

CVE-2026-119210

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-20 #cwe-73 #maven #severity:medium

漏洞预警2026-10-29 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret,...

CVE-2026-119201

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecr

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-552 #npm #severity:medium

漏洞预警2026-10-29 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro ro...

CVE-2026-119200

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-en

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-41 #cwe-436 #cwe-863 #npm

漏洞预警2026-10-29 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/inde...

CVE-2026-119199

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can exp

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-200 #cwe-538 #cwe-552 #npm

漏洞预警2026-10-29 发布MEDIUM

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-er...

CVE-2026-119198

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an expo

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-73 #npm #severity:medium

漏洞预警2026-10-29 发布MEDIUM

PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT c...

CVE-2026-119193

PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Ru

来源摘录 · NVD / GitHub Advisory

#advisory #composer #cve #cwe-379 #severity:medium

漏洞预警2026-10-29 发布MEDIUM

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option pas...

CVE-2026-119186

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, nod

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1284 #cwe-354 #npm #severity:medium

漏洞预警2026-10-29 发布MEDIUM

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(...

CVE-2026-118778

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-476 #npm #severity:medium

漏洞预警2026-10-29 发布MEDIUM

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set...

CVE-2026-118777

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1321 #npm #severity:medium

漏洞预警2026-10-29 发布MEDIUM

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(...

CVE-2026-118773

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including Gl

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory #cve #cwe-400 #npm #severity:medium

漏洞预警2026-10-29 发布MEDIUM

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, ...

CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1,

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory #cve #cwe-405 #npm #severity:medium

安全公告2026-10-29 发布MEDIUM

zip: AES Entry HMAC Authentication Bypass on Premature EOF

CVE-2026-115906

### Summary An AES-encrypted (AE-x) entry's authentication code is verified only when the reader's byte counter lands e

来源摘录 · GitHub Advisory

#advisory #cwe-1284 #cwe-354 #rust #severity:medium

安全公告2026-10-29 发布MEDIUM

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

CVE-2026-9083

### Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulner

来源摘录 · GitHub Advisory

#advisory #cwe-22 #maven #severity:medium

安全公告2026-10-29 发布MEDIUM

Keycloak allows unauthorized access to resources via uma permission ticket bypass

CVE-2026-9799

### Description A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access

来源摘录 · GitHub Advisory

#advisory #cwe-639 #maven #severity:medium

安全公告2026-10-29 发布MEDIUM

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

CVE-2026-9705

### Description A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously i

来源摘录 · GitHub Advisory

#advisory #cwe-613 #maven #severity:medium