CVE-2026-117627

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

EUVD-2026-112636

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

CVE-2026-116684

A flaw was found in the Model Context Protocol MCP Python SDK. This vulnerability allows a remote authenticated attacker to bypass authentication and gain unauthorized access to an MCP server by presenting a valid token issued for a different service. The issue occurs because server-side...

Filelock: StrictSoftFileLock Creates Its Claim Directories Without The Lock Mode, So Another Local User With A Write Bit

"StrictSoftFileLock" and "AsyncStrictSoftFileLock" apply the caller's "mode" to the sentinel the lock file at "" and to both claim files the files whose presence says a process wants or holds the lock. They create the two directories that hold the claims, ".filelock" and ".filelock/claims", with ...

CVE-2026-117627: Red Hat: A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

WordPress HivePress Claim Listings authorization issue vulnerability

WordPress HivePress Claim Listings versions 1.1.4 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, enabling exploitation of improperly configured access control levels...

PT-2026-132399

Name of the Vulnerable Software and Affected Versions @sd-jwt/core versions prior to 0.20.0 @sd-jwt/decode versions prior to 0.20.0 Description In the @sd-jwt/decode component, also utilized by @sd-jwt/core, the system silently drops tampered Disclosures if their digest does not match the...

PT-2026-132134

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4...

CVE-2026-62374: openwallet-foundation: SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

PT-2026-130664

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

CVE-2026-42707: HivePress HivePress Claim Listings: Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting…

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4...

UBUNTU-CVE-2026-110952

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

CVE-2026-112908

"StrictSoftFileLock" and "AsyncStrictSoftFileLock" apply the caller's "mode" to the sentinel the lock file at "" and to both claim files the files whose presence says a process wants or holds the lock. They create the two directories that hold the claims, ".filelock" and ".filelock/claims", with ...

GHSA-6627-M3XW-93MP filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

StrictSoftFileLock and AsyncStrictSoftFileLock apply the caller's mode to the sentinel the lock file at and to both claim files the files whose presence says a process wants or holds the lock. They create the two directories that hold the claims, .filelock and .filelock/claims, with a bare mkdir...

CVE-2026-99104

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scxbypass claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates only...

SUSE CVE-2026-99104

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scxbypass claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates only...

CVE-2026-110952

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

CVE-2026-110952

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

EUVD-2026-112209

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

CVE-2026-99104

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scxbypass claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates only...