CVE-2026-2092 vulnerabilities

Vulnerabilities for packages: keycloak...

EUVD-2026-62961

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedulesearch capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply...

EUVD-2026-62916

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

EUVD-2026-63108

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information...

EUVD-2025-210743

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename...

PT-2026-79191

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description Presenters can submit a presentationId through the '/api/graphql' endpoint that identifies a presentation belonging to a different meeting. The RemovePresentationPubMsgHdlr.scala function fail...

PT-2026-79196

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.1.3 Description An authenticated user with file-edit permissions can disclose the existence and titles of reservations across private trip boundaries. The application fails to use the findForeignLinkTarget function to...

The vulnerability of the ALTER TABLE ALTER TYPE command in the PostgreSQL database management system allows a hacker to gain unauthorized access to delete or modify data.

The vulnerability of the ALTER TABLE ALTER TYPE command in the PostgreSQL database management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to delete or modify data...

PT-2026-78944

Name of the Vulnerable Software and Affected Versions Altair versions prior to 5.2.3 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 5.2.2...

PT-2026-80755

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description The backend FileUpload form widget improperly trusts the file id POST parameter when resolving attachments. The getFileRecord function resolves the provided ID against the global system files tab...

PT-2026-78992

Name of the Vulnerable Software and Affected Versions EPROLO Dropshipping versions prior to 2.4.3 Description Broken access control allows unauthenticated users to gain unauthorized access to restricted areas or functions of the system. Recommendations Update to a version newer than 2.4.2...

PT-2026-79264

A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability WRR Enterprise Edition...

PT-2026-79188

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

PT-2026-79261

Name of the Vulnerable Software and Affected Versions EverShop versions prior to 2.2.1 Description An authorization flaw exists in the customer update route. The route is incorrectly configured as public, allowing the admin authentication middleware to bypass caller verification. Additionally, th...

PT-2026-79095

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9 Description Page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidde...

PT-2026-80770

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.9 Wagtail versions prior to 7.3.4 Wagtail versions prior to 7.4.3 Wagtail versions prior to 8.0rc2 Description The internal Pages admin API returns page fields declared in api fields without sufficient access...

PT-2026-78974

Name of the Vulnerable Software and Affected Versions Homlisti versions prior to 3.1.3 Description Broken access control exists for subscribers, allowing unauthorized access or actions. Recommendations Update to a version newer than 3.1.2...

PT-2026-78993

Name of the Vulnerable Software and Affected Versions Koji versions prior to 2.2.2 Description An unauthenticated broken access control issue exists, allowing users to bypass authorization mechanisms without providing valid credentials. Recommendations Update to a version newer than 2.2.1...

PT-2026-78907

Name of the Vulnerable Software and Affected Versions Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 affected versions not specified Description An issue exists where improper enforcement of role-based access control allows a low privileged remote attacker with a valid session to create new...

PT-2026-79046

Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An issue allows any user authenticated to the manager to create, modify, and delete Data Node definitions, leading to files or directories being accessible to external parties...