CVE-2023-4910Medium· 5.5▾ TwilightPoC availableA flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 30.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.
3scale-admin-portal (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
No mitigation is yet available for this flaw.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-3019High· 8.8Pcp: exposure of the redis server backend allows remote command execution via pmproxy
CVE-2026-117691Critical· 9.1Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names
CVE-2026-120984Critical· 9.1Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import
CVE-2026-83495NoneTrainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration
CVE-2026-50240High· 8.8Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount
CVE-2026-123876Medium· 4.4Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation