Exploit for CVE-2026-36851

CVE-2026-36851 Path traversal in UnPollerhttps://github.co...

CVE-2026-8489: Improper Neutralization of Input During Web Page Generation

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aboutme' parameter in all versions up to, and including, 2.11.4 due to insufficient input sanitization and...

9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

Summary 9router uses a publicly known hardcoded string "9router-default-secret-change-me" as the fallback of JWT secret for all Dashboard session JWTs when the JWTSECRET environment variable is not set. Because this secret is committed in the public repository and unchanged across all releases, a...

org.keycloak:keycloak-account-freemarker (1.0-beta-1), org.keycloak:keycloak-login-freemarker (1.0-beta-1) potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0-beta-1)

org.keycloak:keycloak-services MAVEN version 1.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-1 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.0.2.final), org.keycloak:keycloak-dependencies-server-all (1.0.2.final) +3 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0.2.final)

org.keycloak:keycloak-services MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0.2.final -...

org.keycloak:keycloak-account-freemarker (1.0-beta-1-20150521), org.keycloak:keycloak-login-freemarker (1.0-beta-1-20150521) +1 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0-beta-1-20150521)

org.keycloak:keycloak-services MAVEN version 1.0-beta-1-20150521 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-1-20150521 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.0.2, <=1.1.0-alpha.1), org.keycloak:keycloak-account-freemarker (1.0.4.final) +4 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0.4.final)

org.keycloak:keycloak-services MAVEN version 1.0.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.0.2, =1.1.0-alpha.1 -...

org.keycloak:keycloak-account-freemarker (1.1.0.beta1), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta1) +1 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.1.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1), org.keycloak:keycloak-account-freemarker (1.0-beta-3) +1 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0-beta-3)

org.keycloak:keycloak-services MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =0.11.0, =1.0.0.beta1 -...

org.keycloak:keycloak-account-freemarker (1.0-alpha-2), org.keycloak:keycloak-login-freemarker (1.0-alpha-2) +1 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0-alpha-2)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-2 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.0-alpha-3), org.keycloak:keycloak-login-freemarker (1.0-alpha-3) +1 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0-alpha-3)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-3 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.0.3.final), org.keycloak:keycloak-dependencies-server-all (1.0.3.final) +3 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0.3.final)

org.keycloak:keycloak-services MAVEN version 1.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0.3.final -...

org.keycloak:keycloak-account-freemarker (1.1.1.final), org.keycloak:keycloak-dependencies-server-min (1.1.1.final) +1 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.1.1.final)

org.keycloak:keycloak-services MAVEN version 1.1.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.1.final -...

org.keycloak:keycloak-account-freemarker (1.0-beta-2), org.keycloak:keycloak-login-freemarker (1.0-beta-2) potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0-beta-2)

org.keycloak:keycloak-services MAVEN version 1.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-2 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.0-alpha-4), org.keycloak:keycloak-login-freemarker (1.0-alpha-4) +1 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0-alpha-4)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-4 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.1.0.beta2), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta2) +1 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.1.0.beta2)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta2 -...

com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=11.0.2), fr.cnieg.keycloak:attribute-login-provider (>=1.1.0, <=1.2.4) +9 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (11.0.2)

org.keycloak:keycloak-services MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport =11.0.1, =1.1.0, =1.2.4 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.final), org.keycloak:keycloak-account-freemarker (1.0-rc-1) +4 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0-rc-1)

org.keycloak:keycloak-services MAVEN version 1.0-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.final -...

CVE-2026-58466

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via adddefaultuser in the database user module when the users table is empt...

CVE-2026-58466 AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add_default_user()

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via adddefaultuser in the database user module when the users table is empt...