CVE-2026-92603 ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message r...

CVE-2026-92603

ContiNew Admin through 4.1.0 contains an authorization bypass in the personal message delete endpoint (UserMessageController). The vulnerable code fails to validate message ownership when processing the IdsReq parameter, allowing any authenticated user to supply arbitrary message identifiers to d...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.7 Images Security Update

New images are available for Red Hat build of Keycloak 26.6.7 and Red Hat build of Keycloak 26.6.7 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

CVE-2026-17526 Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

CVE-2026-17526

CVE-2026-17526 is a privilege escalation vulnerability in Keycloak (open-source identity and access management), specifically in the keycloak-services component. A user holding the impersonation role can impersonate a realm administrator , gaining full administrative control over the realm—includ...

keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...

keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

CVE-2026-92466

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including use...

CVE-2026-73169

Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store...

EUVD-2026-80704

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including use...

CVE-2026-92466 microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including use...

CVE-2026-92466

CVE-2026-92466 affects zlt2000 microservices-platform through version 6.0.0 . The root cause is the configuration flag zlt.security.auth.urlPermission.enable defaulting to false , which disables all URL-level permission checks after a user has authenticated. As a result, any authenticated user wi...

EUVD-2026-80700

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without...

EUVD-2026-80731

Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store...

CVE-2026-92463

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

CVE-2026-40854

WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/loginuser. An attacker can bypass authentication b...