Статьи Support
🚨 CVE-2026-92856
A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security...
🚨 CVE-2026-96447
A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username...
🚨 CVE-2026-96460
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an...
🚨 CVE-2026-96547
A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid...
🚨 CVE-2026-97367
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's...
🚨 CVE-2026-97848
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role...
🚨 CVE-2026-113431
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields.
cow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes...
🚨 CVE-2026-115701
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.
Once a request has been received in full and its handler is still running, cowboy_http:parse/2...
🚨 CVE-2026-116630
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a...
🚨 CVE-2026-123276
In JetBrains CLion before 2026.3,
2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile
🚨 CVE-2026-123277
In JetBrains CLion before 2026.3,
2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux
🚨 CVE-2026-123278
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
🚨 CVE-2026-123279
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
🚨 CVE-2026-123280
In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
🚨 CVE-2026-123281
In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
🚨 CVE-2026-123282
In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
🚨 CVE-2026-123284
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content
🚨 CVE-2026-123285
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection
🚨 CVE-2026-123286
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
🚨 CVE-2026-123287
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
Защита от мошенничества: Использование посредника минимизирует риски столкнуться с «продавцами-однодневками» или недобросовестными заказчиками, которые исчезают после получения предоплаты или результата работы.