CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97311

A flaw in the Admin REST API of Keycloak , an identity and access management solution, allows for unauthorized information disclosure. Specifically, endpoints used to retrieve groups associated with a specific role fail to properly verify individual group visibility permissions . This vulnerabili...

CVE-2026-97311

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97311

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

EUVD-2026-85793

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177

A flaw in the Keycloak Admin REST API user update mechanism allows for a permission bypass when Fine-Grained Admin Permissions are enabled. The system fails to validate specific password reset authorizations during general user profile updates. This allows a delegated administrator —who should be...

CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-96810 huanzi-qch base-admin Add User CommonController.java save cross site scripting

A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\src\main\java\cn\huanzi\qch\baseadmin\common\controller\CommonController.java of the component Add User Handler. The...

CVE-2026-96810

A cross-site scripting (XSS) vulnerability exists in the huanzi-qch base-admin software (up to commit 52816b760cd53244989fd664bbb2b3d4edbfdbf1). The flaw is located within the Add User Handler component, specifically affecting the Save function of the base-admin-master\src\main\java\cn\huanzi\qch...

CVE-2026-96810 huanzi-qch base-admin Add User CommonController.java save cross site scripting

A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\src\main\java\cn\huanzi\qch\baseadmin\common\controller\CommonController.java of the component Add User Handler. The...

EUVD-2026-85710

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirmloggedin/confirmuser of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The...

EUVD-2026-85674

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...

CVE-2026-96810: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\src\main\java\cn\huanzi\qch\baseadmin\common\controller\CommonController.java of the component Add User Handler. The...

PT-2026-104993

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl-ioerr work to abort inflight requests. This ends up calling nvme fc abor...

CVE-2026-77825: Improper Limitation of a Pathname to a Restricted Directory

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

PT-2026-97837

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 Description An authenticated administrator can perform path traversal via the Admin API log-download endpoint GET /v1/admin/logs/file. The issue occurs because the path confinement chec...