CVE-2026-92783 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/id endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects...

CVE-2026-92783 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/id endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects...

CVE-2026-92783 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/id endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects...

CVE-2026-76413 Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability

A vulnerability in Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An...

CVE-2026-76413 Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability

A vulnerability in Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An...

EUVD-2026-81120

A vulnerability in Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An...

CVE-2026-76413

A vulnerability in the Cisco ASDM single sign-on (SSO) handler for Cisco Secure FMC Software allows an unauthenticated, remote attacker to forge a session token and log in as the ASDM administrator. The root cause is improper management of the SSO token . By repeating the attack, an attacker can ...

CVE-2026-19607

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

EUVD-2026-80855

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-19607

A flaw in the first-broker-login flow of the keycloak-services component in Red Hat build of Keycloak allows an attacker to register a matching username on an external identity provider, triggering a username collision that locks out the legitimate user. The root cause is insufficient validation ...

CVE-2026-19607 Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-19607 Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

keycloak-services: keycloak-services: Broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

keycloak-services: keycloak-services: Broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-19607

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-19607: Improper Authentication

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

PT-2026-93821

Name of the Vulnerable Software and Affected Versions keycloak-services affected versions not specified Description A flaw exists in the first-broker-login flow of the keycloak-services component, which manages initial authentication and account linking for users logging in via external identity...

PT-2026-94060

Name of the Vulnerable Software and Affected Versions Yeti versions prior to 2.11.1 Description Insufficient validation of caller permissions in the 'DELETE /api/v2/rbac/id' endpoint allows users with read access to delete access control relationships. This can enable attackers to revoke the...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. A race condition in the password lockout code may lead to the risk of brute-force attacks succeeding if certain conditions are met...

Astra Linux – Vulnerability in Tomcat9

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protections provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65...