CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97311

A flaw in the Admin REST API of Keycloak , an identity and access management solution, allows for unauthorized information disclosure. Specifically, endpoints used to retrieve groups associated with a specific role fail to properly verify individual group visibility permissions . This vulnerabili...

CVE-2026-97311

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

EUVD-2026-85793

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177

A flaw in the Keycloak Admin REST API user update mechanism allows for a permission bypass when Fine-Grained Admin Permissions are enabled. The system fails to validate specific password reset authorizations during general user profile updates. This allows a delegated administrator —who should be...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

Exploit for Interpretation Conflict in Wordpress

WP2Shell — CVE-2026-63030 + CVE-2026-60137 WordPress Core Pre-...

CVE-2026-97177: Missing Authorization

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

PT-2026-97787

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role fail to properly verify...

CVE-2026-97311: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

PT-2026-97704

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system does not verify specific password reset authorizations...

CVE-2026-86783

The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including...

CVE-2026-86785

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state...

CVE-2026-84741

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

CVE-2026-84742

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

CVE-2026-84027

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

CVE-2026-86783

The Post Grid Gutenberg Blocks WordPress plugin (versions before 5.0.41 ) contains a vulnerability where it fails to perform proper authorization or post-visibility checks on a specific REST API route. This flaw allows unauthenticated users to disclose the custom field key names of arbitrary post...