VulniPulse uses Google Ads measurement to understand visits from advertisements and campaign performance. It runs cookie-free until you choose — accepting enables cookies for more accurate attribution. Rejecting keeps it cookie-free and never limits the site.
See exactly what is measuredComplete feed
738 advisories across 32 monitored vendors.
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to already possess administrative privileges (query-users role) and knowledge of the target user's ID. Successful exploitation allows an attacker to bypass fine-grained authorization controls to view sensitive user data they are not authorized to see. The vulnerability's root cause is a missing authorization check in the BruteForceUsersResource component of the Admin UI extension. Weakness: CWE-639. Affected Red Hat products: Red Hat Build of Keycloak; Red Hat JBoss Enterprise Application Platform Expansion Pack. Red Hat does not currently list a fixing RHSA for this CVE.
Denial of Service via crafted OpenWire Message. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770.
Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) Upstream bug(s): https://code.google.com/p/chromium/issues/detail?id=513454805 Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Weakness: CWE-653.
Improper Authorization Allows Security Constraint Bypass. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-551.
Replay attack via improper authentication in EncryptionInterceptor. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-294. Red Hat lists fixing advisory RHSA-2026:29203 with package tomcat11-main-11.0.23-0.1.hum1, tomcat10-main-10.1.56-1.hum1.
Incorrect control flow in rewrite valve allows unexpected rule processing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-358. Red Hat lists fixing advisory RHSA-2026:29203 with package tomcat11-main-11.0.23-0.1.hum1, tomcat10-main-10.1.56-1.hum1.
Cross-Site Scripting vulnerability in number guess example. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:32960 with package tomcat11-main-11.0.23-0.1.hum1.
@anthropic-ai/claude-code: Claude Code: Information disclosure and file overwrite via insecure temporary file in /copy command. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-59.
Arbitrary code execution in xmlcatalog utility via buffer overflow. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-120. Red Hat lists fixing advisory RHSA-2026:33840 with package libxml2-main-2.15.3-0.1.1.hum1.
TOCTOU Symlink Traversal via getfacl/setfacl. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-367. Red Hat lists fixing advisory RHSA-2026:34351 with package acl-main-2.4.0-0.1.hum1.
Symlink Traversal Privilege Escalation via getfattr and setfattr. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:34889 with package attr-main-2.6.0-9.1.hum1.
Arbitrary file overwrite via insecure temporary file handling in gzexe utility. Red Hat rates this moderate (CVSS 6). Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:33771 with package gzip-main-1.14-2.2.hum1.
In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source. This vulnerability occurs in virtualized environments lacking a physical AMD northbridge.
antlr ANTLR4: Path traversal via manipulation of getImportedVocabFile function. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-22.
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. A reply to the GitHub issue explains, that "[t]he labeling schema PR has not been merged yet. The auth handlers will be added before the release." A flaw was found in MLflow. This could lead to unauthorized access or manipulation of data within the affected component. This issue primarily affects specific MLflow components within the OpenShift AI environment. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-639. Affected Red Hat products: Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Denial of Service via crafted IPv6 response. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125.
Denial of service or information disclosure via malformed SSH publickey response. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-824.
Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. A flaw was found in Nx, a monorepo solution for managing multiple projects. This misconfiguration allows a remote attacker to read sensitive project information, such as the full project graph, from a developer's system when they visit a malicious website. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N). Weakness: CWE-346. Affected Red Hat products: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10. Red Hat does not currently list a fixing RHSA for this CVE.
OAuth2 filter late async token completion after stream teardown (UAF / crash risk). Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-416.
ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-416.