CVE-2026-67218

A flaw was found in RabbitMQ. A user with management tag and virtual host vhost access, but lacking configure permissions, can exploit a vulnerability in the HTTP API for super-stream creation. This flaw allows the user to bypass permission checks and create persistent cluster-wide resources, suc...

Malicious code in eslint-config-compact-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc01e3a8316b2d4e11b34a9c8cbe1cf5bd2af83a6a70052e40a22b54f13f78b index.js executes on module load and collects host reconnaissance data — os.platform, os.hostname, os.userInfo.username, architecture, Node version,...

MAL-2026-17157 Malicious code in eslint-config-compact-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc01e3a8316b2d4e11b34a9c8cbe1cf5bd2af83a6a70052e40a22b54f13f78b index.js executes on module load and collects host reconnaissance data — os.platform, os.hostname, os.userInfo.username, architecture, Node version,...

CVE-2026-97311

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-16302

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

EUVD-2026-85856

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

CVE-2026-16302 Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

CVE-2026-16302 Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

CVE-2026-16302

The Spectra Legacy – Gutenberg Blocks plugin for WordPress (versions up to and including 2.20.0 ) is vulnerable to Sensitive Information Exposure . The root cause is a missing capability check in the editor_assets function, which exposes the uag_insta_linked_accounts option via the uagb_blocks_in...

CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

EUVD-2026-85853

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97311

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97311

A flaw in the Admin REST API of Keycloak , an identity and access management solution, allows for unauthorized information disclosure. Specifically, endpoints used to retrieve groups associated with a specific role fail to properly verify individual group visibility permissions . This vulnerabili...

CVE-2026-97311

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-67221

A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 1.0 shovel component incorrectly stores connection Uniform Resource Identifiers URIs with embedded plaintext passwords. This information can be exposed to an authenticated attacker with monitoring privileges via the...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

EUVD-2026-85793

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...