keycloak-services: keycloak-services: SAML IdP-initiated broker login bypasses link-only restriction

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

CVE-2026-71293

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...

CVE-2026-71201

In OpenStack Ironic through 38.0.0, a project reader that makes a craf...

CVE-2026-18572

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

CVE-2026-45086

CVE-2026-45086 (Decidim) affects the demographics questionnaire admin editor feature. A route under /admin/demographics/questions renders the editor interface without validating admin authorization, allowing a normal participant to access and view the live update form action. This constitutes an ...

CVE-2026-18214

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This mean...

EUVD-2026-51485

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This mean...

CVE-2026-17825

Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. Chromium security severity: Medium...

MongoDB 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-125872)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU...

Apache ActiveMQ < 5.19.9 / 6.x < 6.2.8 Multiple Vulnerabilities

The version of Apache ActiveMQ running on the remote host is prior to 5.19.9 or 6.x prior to 6.2.8. It is, therefore, affected by multiple vulnerabilities: - Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that c...

CVE-2026-58159

Apache Traffic Server is affected by a vulnerability in Listener and ACL handling that allows bypass of IP access controls on UDS listeners and via ACL matching errors. Affected versions: 8.0.0–8.1.9, 9.0.0–9.2.14, 10.0.0–10.1.3. Fixed in 9.2.15 and 10.1.4. If exploiting details are not provided ...

CVE-2026-58156

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

The Token Content Access module enables site administrators to provide access to content using access tokens. The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass acce...

GHSA-7R7X-GJVR-448G Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...

CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent...

GHSA-6QC9-MQVW-JG7X n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

Impact An authenticated member with edit access to a shared workflow could reference another user's credential in an HTTP Request node while specifying the credential type through an expression. Because the pre-execution permission check compared the unresolved expression instead of the real...

CVE-2026-64793 Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions

Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to...

CVE-2026-64793

CVE-2026-64793 affects Joomla Extensions Articles Anywhere and Modules Anywhere by regularlabs.com. The issue is that content tags could use ignore flags or property overrides to render restricted or unpublished articles/modules, allowing a content author to expose content to visitors who lack re...

Security Bulletin: Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-3482)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed Access Control security vulnerability. Vulnerability Details CVEID:CVE-2026-3482 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway could allow an unauthenticated user to read sensitive informatio...

CVE-2026-65012

CVE-2026-65012 affects InvokeAI prior to 6.13.7. An unauthenticated vulnerability in GET /api/v2/models/scan_folder allows attacker-controlled scan_path to recursively enumerate arbitrary server filesystem directories, revealing existence/readability via HTTP response codes and bypassing multi-us...