rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-9136 libretro RetroArch file_stream.c filestream_vscanf out-of-bounds
A flaw has been found in libretro RetroArch 1.18.0/1.19.0/1.20.0. This affects the function filestream_vscanf of the file libretro-common/streams/file_stream.c. This manipulation causes out-of-bounds read. The attack needs to be launched locally. Upgrading to version 1.21.0 mitigates this issue. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-125
description: Out-of-Bounds Read
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: libretro
product: RetroArch
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: Simcha Kosman
lang: en
value: simkca (VulDB User)
Published: 2025-08-19T11:32:08.147Z
CVE-2025-9137 Scada-LTS scheduled_events.shtm cross site scripting
A vulnerability has been found in Scada-LTS 2.7.8.1. This impacts an unknown function of the file scheduled_events.shtm. Such manipulation of the argument alias leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower. An admin user - by definition - has full control over HTML and JS code that is delivered to users in regular synoptic panels. In other words - due to the design of the system it is not possible to limit the admin user to attack the users."
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: n/a
product: Scada-LTS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Karina Gante (CVE-Hunters)
lang: en
value: karinagante (VulDB User)
lang: en
value: karinagante (VulDB User)
Published: 2025-08-19T12:02:06.817Z
CVE-2025-9138 Scada-LTS new cross site scripting
A vulnerability was found in Scada-LTS 2.7.8.1. Affected is an unknown function of the file pointHierarchy/new/. Performing manipulation of the argument Title results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower. An admin user - by definition - has full control over HTML and JS code that is delivered to users in regular synoptic panels. In other words - due to the design of the system it is not possible to limit the admin user to attack the users."
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: n/a
product: Scada-LTS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Karina Gante (CVE-Hunters)
lang: en
value: karinagante (VulDB User)
lang: en
value: karinagante (VulDB User)
Published: 2025-08-19T12:32:06.416Z
CVE-2025-9139 Scada-LTS WatchListDwr.init.dwr information disclosure
A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr. Executing manipulation can lead to information disclosure. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower."
Problem types: cwe_id: CWE-200
description: Information Disclosure
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: n/a
product: Scada-LTS
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Natan Morette (CVE-Hunters)
lang: en
value: nmmorette (VulDB User)
lang: en
value: nmmorette (VulDB User)
Published: 2025-08-19T13:02:06.113Z
CVE-2025-9140 Shanghai Lingdang Information Technology Lingdang CRM tabdetail_moduleSave.php sql injection
A vulnerability was identified in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this issue is some unknown functionality of the file /crm/crmapi/erp/tabdetail_moduleSave.php. The manipulation of the argument getvaluestring leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 8.6.5.4 can resolve this issue. The affected component should be upgraded. The vendor explains: "All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+."
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Shanghai Lingdang Information Technology
product: Lingdang CRM
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Published: 2025-08-19T13:32:06.591Z
CVE-2025-9142 Local privilege escalation in Harmony SASE Windows Agent
A local user can trigger Harmony SASE Windows client to write or delete files outside the intended certificate working directory.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
Affected products: vendor: checkpoint
product: Hramony SASE
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Published: 2026-01-14T14:30:48.630Z
CVE-2025-9143 Scada-LTS mailing_lists.shtm cross site scripting
A security flaw has been discovered in Scada-LTS 2.7.8.1. This affects an unknown part of the file mailing_lists.shtm. The manipulation of the argument name/userList/address results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: n/a
product: Scada-LTS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Karina Gante (CVE-Hunters)
lang: en
value: karinagante (VulDB User)
lang: en
value: karinagante (VulDB User)
Published: 2025-08-19T15:02:06.334Z
CVE-2025-9144 Scada-LTS publisher_edit.shtm cross site scripting
A weakness has been identified in Scada-LTS 2.7.8.1. This vulnerability affects unknown code of the file publisher_edit.shtm. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: n/a
product: Scada-LTS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Karina Gante (CVE-Hunters)
lang: en
value: karinagante (VulDB User)
lang: en
value: karinagante (VulDB User)
Published: 2025-08-19T15:02:08.496Z
CVE-2025-9145 Scada-LTS SVG File view_edit.shtm cross site scripting
A security vulnerability has been detected in Scada-LTS 2.7.8.1. This issue affects some unknown processing of the file view_edit.shtm of the component SVG File Handler. Such manipulation of the argument backgroundImageMP leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: n/a
product: Scada-LTS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Karina Gante (CVE-Hunters)
lang: en
value: karinagante (VulDB User)
lang: en
value: karinagante (VulDB User)
Published: 2025-08-19T15:32:07.391Z
CVE-2025-9146 Linksys E5600 Firmware checkFw.sh verify_gemtek_header risky encryption
A flaw has been found in Linksys E5600 1.1.0.26. The affected element is the function verify_gemtek_header of the file checkFw.sh of the component Firmware Handler. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-327
description: Risky Cryptographic Algorithm
cwe_id: CWE-310
description: Cryptographic Issues
Affected products: vendor: Linksys
product: E5600
CVSS v3.1: version: 3.1
baseScore: 6.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: IOT_Res (VulDB User)
Published: 2025-08-19T16:02:06.364Z
CVE-2025-9147 jasonclark getsemantic index.php cross site scripting
A vulnerability has been found in jasonclark getsemantic up to 040c96eb8cf9947488bd01b8de99b607b0519f7d. The impacted element is an unknown function of the file /index.php. The manipulation of the argument view leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: jasonclark
product: getsemantic
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: dev03301 (VulDB User)
Published: 2025-08-19T16:32:06.108Z
CVE-2025-9148 CodePhiliaX Chat2DB JDBC Connection DataSourceController.java sql injection
A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects an unknown function of the file ai/chat2db/server/web/api/controller/data/source/DataSourceController.java of the component JDBC Connection Handler. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: CodePhiliaX
product: Chat2DB
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: jmx0hxq (VulDB User)
Published: 2025-08-19T17:02:06.237Z
CVE-2025-9149 Wavlink WL-NU516U1 wireless.cgi sub_4032E4 command injection
A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425. This impacts the function sub_4032E4 of the file /cgi-bin/wireless.cgi. This manipulation of the argument Guest_ssid causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Wavlink
product: WL-NU516U1
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: QMSSDXN (VulDB User)
Published: 2025-08-19T17:32:06.085Z
CVE-2025-9150 Surbowl dormitory-management-php violation_add.php sql injection
A vulnerability was identified in Surbowl dormitory-management-php up to 9f1d9d1f528cabffc66fda3652c56ff327fda317. Affected is an unknown function of the file /admin/violation_add.php?id=2. Such manipulation of the argument ID leads to sql injection. The attack may be performed from a remote location. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Surbowl
product: dormitory-management-php
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: xin_zfyyz (VulDB User)
Published: 2025-08-19T17:32:08.223Z
CVE-2025-9151 LiuYuYang01 ThriveX-Blog web updateJsonValueByName improper authorization
A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /web_config/json/name/web. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-285
description: Improper Authorization
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: LiuYuYang01
product: ThriveX-Blog
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: echo0d (VulDB User)
Published: 2025-08-19T18:02:06.380Z
CVE-2025-9152 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint.

A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.
Affected products: vendor: WSO2
product: WSO2 API Manager
default_status: unaffected
vendor: WSO2
product: WSO2 API Control Plane
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: crnković
Published: 2025-10-16T12:37:00.966Z
CVE-2025-9153 itsourcecode Online Tour and Travel Management System travellers.php unrestricted upload
A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument photo results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: itsourcecode
product: Online Tour and Travel Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: hjscs (VulDB User)
Published: 2025-08-19T18:32:08.442Z
CVE-2025-9154 itsourcecode Online Tour and Travel Management System page-login.php sql injection
A flaw has been found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /user/page-login.php. This manipulation of the argument email causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Online Tour and Travel Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: hjscs (VulDB User)
Published: 2025-08-19T19:02:06.287Z
CVE-2025-9155 itsourcecode Online Tour and Travel Management System forget_password.php sql injection
A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Impacted is an unknown function of the file /user/forget_password.php. Such manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Online Tour and Travel Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: hjscs (VulDB User)
Published: 2025-08-19T19:32:07.042Z
CVE-2025-9156 itsourcecode Sports Management System sports.php sql injection
A vulnerability was found in itsourcecode Sports Management System 1.0. The affected element is an unknown function of the file /Admin/sports.php. Performing manipulation of the argument code results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Sports Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: kangsf1989 (VulDB User)
Published: 2025-08-19T19:32:10.183Z
CVE-2025-9157 appneta tcpreplay tcprewrite edit_packet.c untrunc_packet use after free
A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2. The impacted element is the function untrunc_packet of the file src/tcpedit/edit_packet.c of the component tcprewrite. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. This patch is called 73008f261f1cdf7a1087dc8759115242696d35da. Applying a patch is advised to resolve this issue.
Problem types: cwe_id: CWE-416
description: Use After Free
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: appneta
product: tcpreplay
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: HeureuxBuilding (VulDB User)
Published: 2025-08-19T20:02:08.552Z
CVE-2025-9158 Stored XSS in Request Tracker
The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. 

This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Best Practical
product: Request Tracker
default_status: unaffected
Credits: lang: en
value: Mateusz Szymaniec (CERT Polska)
Published: 2025-10-24T06:00:10.918Z
CVE-2025-9160 Rockwell Automation CompactLogix® 5480 Code Execution Vulnerability
A code execution security issue exists in the affected product. An attacker with physical access could abuse the maintenance menu of the controller with a crafted payload. The security issue can result in arbitrary code execution.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Rockwell Automation
product: CompactLogix® 5480
default_status: unaffected
Published: 2025-09-09T12:30:45.806Z
CVE-2025-9161 Rockwell Automation FactoryTalk Optix Remote Code Execution Vulnerability
A security issue exists within FactoryTalk Optix MQTT broker due to the lack of URI sanitization. This flaw enables the loading of remote Mosquito plugins, which can be used to achieve remote code execution.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Rockwell Automation
product: FactoryTalk Optix
default_status: unaffected
Published: 2025-09-09T12:57:40.934Z
CVE-2025-9162 Org.keycloak/keycloak-model-storage-service: variable injection into environment variables
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process
allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.
Problem types: cwe_id: CWE-526
description: Cleartext Storage of Sensitive Information in an Environment Variable
Affected products: vendor: Keycloak
product: keycloak
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0
cpes: cpe:/a:redhat:build_keycloak:26.0
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0
cpes: cpe:/a:redhat:build_keycloak:26.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0
cpes: cpe:/a:redhat:build_keycloak:26.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0
cpes: cpe:/a:redhat:build_keycloak:26.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2.9
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-08-21T15:40:25.136Z