DNS Rebinding

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to DNS Rebinding in the client host restriction logic. An attacker can bypass wildcard domain restrictions on...

Improper Validation of Consistency within Input

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input during OIDC authentication flow processing. An attacker can...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the Google token exchange flow in the Google Identity Provider token exchange...

Improper Authentication

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Authentication through the Microsoft account token exchange flow in the Microsoft identity provider...

RHSA-2026:46482 Red Hat Security Advisory: sssd security update

Bulletin has no description...

CVE-2026-58404

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

igloohome Smart Lock Mobile Application

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure...

Veeder-Root TLS4B Command Injection (CVE-2025-58428)

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote...

WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action vulnerability

Unauthenticated Sensitive Information Exposure in 'wpbotsendemailtranscript' AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin ChatBot versions = 8.5.9...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Hugging Face Transformers [CVE-2025-14920, CVE-2025-14921, CVE-2025-14926, CVE-2025-14927]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Hugging Face Transformers CVE-2025-14920, CVE-2025-14921, CVE-2025-14926, CVE-2025-14927. Hugging Face Transformers is used in our speech services runtimes. These vulnerabilities have been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server-Side Request Forgery (SSRF) in LangChain [CVE-2026-41481]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Server-Side Request Forgery SSRF in LangChain, due to a failure to revalidate to redirect targets, allowing a URL pointing to an attacker-controlled server to potentially redirect to internal, localhost, or cloud metadata endpoints,...

CVE-2026-65618

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service (ReDoS) in Spring Framework [CVE-2026-41848]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service ReDoS in Spring Framework CVE-2026-41848. Spring Framework is used as part of our microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple D.o.S. issues in Micrometer [CVE-2026-40983, CVE-2026-40984]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple D.o.S. issues in Micrometer due to issues in CVE-2026-40983, CVE-2026-40984. Micrometer is used in our speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerabili...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in urllib3 [CVE-2026-44431, CVE-2026-44432]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in urllib3 CVE-2026-44431, CVE-2026-44432, urllib3 is used in our speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-4443...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an authorization bypass in Moby [CVE-2026-34040]

Summary IBM Watson Speech Services Cartridge is vulnerable to an authorization bypass in Moby, due to a flaw that allows attackers to bypass authorization plugins AuthZ CVE-2026-34040. Moby is used in our speech catalog. This vulnerability has been addressed. Please read the details for remediati...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a privilege validation bypass in Moby [CVE-2026-33997]

Summary IBM Watson Speech Services Cartridge is vulnerable to a privilege validation bypass in Moby, due to an error in the daemon's privilege comparison logic, which allows the daemon to incorrectly accept a privilege set that differs from the one approved by the user CVE-2026-33997. Moby is use...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to incomplete validation in LangChain [CVE-2026-40087]

Summary IBM Watson Speech Services Cartridge is vulnerable to incomplete validation in LangChain, due to flaws in the f-string prompt-template. CVE-2026-40087. LangChain is used in our speech runtimes. This vulnerability has been addressed. Please read the details for remediation below...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in google.protobuf [CVE-2026-0994]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in google.protobuf, due to an issue that allows maxrecursiondepth limit to be bypassed when parsing nested google.protobuf.Any messages. CVE-2026-0994. Google.protobuf is used in our speech service runtimes. This...