Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.13 Images Security Update

New images are available for Red Hat build of Keycloak 26.4.13 and Red Hat build of Keycloak 26.4.13 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.13 Security Update

New Red Hat build of Keycloak 26.4.13 packages are available from the Customer Portal Red Hat build of Keycloak 26.4.13 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

org.keycloak.keycloak-services: Improper Access Control on Keycloak Server when the account Account API feature is disabled

When Keycloak is started with --features-disabled=account,account-api, the Account REST API is only partially disabled. Five endpoints under the versioned path /account/v1alpha1 remain fully functional — including both read and write operations — because they lack the checkAccountApiEnabled gate...

CVE-2026-54096

File Browser exposes a vulnerability: an authenticated user can create a public share for a path that does not yet exist, and that share becomes valid later when a file is created at that path, potentially exposing future files via GET /api/public/dl/. The issue is triggered by POST /api/share/, ...

CVE-2026-54096 File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, POST /api/share/ accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target fi...

CVE-2026-54096 File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, POST /api/share/ accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target fi...

CVE-2026-55667

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, a...

CVE-2026-56445

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:36+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsma-26-176-01 2026-06-25 21:15:02+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-176-01 2026-06-25 22:05:41+00:00| seen|...

CVE-2026-56414

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:34+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-05 2026-06-27 01:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpacpui4i32p 2026-06-27 01:30:36+00:00| seen|...

CVE-2026-9718

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:29+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-07...

CVE-2026-54479

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:19+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02 2026-06-25 22:13:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5hbievx22w 2026-06-25 23:10:37+00:00| seen|...

CVE-2026-50176

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:17+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02 2026-06-25 22:10:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5h442yld22...

CVE-2026-31928

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:12+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04 2026-06-27 01:51:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpadupa4lk2o 2026-06-27 09:00:28+00:00| seen|...

CVE-2026-33560

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:09+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04 2026-06-27 01:56:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpae5o2mik2u 2026-06-27 10:30:28+00:00| seen|...

CVE-2026-12473

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:04+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsma-26-176-02 2026-06-25 21:15:04+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-176-02 2026-06-25 22:50:25+00:00| seen|...

CVE-2026-12897

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:02+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-03 2026-06-25 22:53:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5jhufu2j25...

[SECURITY] Fedora 43 Update: goose-1.36.0-1.fc43

Goose is your on-machine AI agent, capable of automating complex development tasks from start to finish. More than just code suggestions, goose can build entire projects from scratch, write and execute code, debug failures, orchestrate workflows, and interact with external APIs - autonomously...

EUVD-2026-39472

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 FGAPv2 is enabled, an attacker wi...

CVE-2026-55411

ToolJet prior to 3.20.1780-lts exposes a cross-tenant confidentiality flaw: authenticated users can decrypt any organization’s data-source secret via POST /api/data-sources/decrypt by supplying a credential_id, because the handler bypasses ValidateDataSourceGuard and ignores organization scoping ...

CVE-2026-55477 Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code...