CVE-2023-31711

CVE-2023-31711 Incorrect Access Control in ZKTECO allows remote attackers to read any file via the administrative API. Installing required modules Inside the directory ZKTEco: $ pip install -r ./pyzatt/requirementsdev.txt Running the exploit Inside the directory ZKTEco: $ python exploit.py...

CLEANSTART-2026-FD75876 Keycloak provides a way to manage identity providers and organizations through its administrative API

Security vulnerability affects the keycloak package. Keycloak provides a way to manage identity providers and organizations through its administrative API...

Esri Portal for ArcGIS 11.1 / 11.3 < Security 2026 Update 3 HTML Injection (CVE-2026-69237)

The version of Esri Portal for ArcGIS installed on the remote host is 11.1 or 11.3 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by a vulnerability: - An HTML injection vulnerability exists in Esri Portal for ArcGIS that allows a remote attacker with administrative...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization via improper access control in the OAuth client management process. An attacker can gain unauthorized administrative API access by registering OAuth...

Couchbase Server - Broken Access Control

Couchbase Server versions 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0-4.6.5, 5.0.0, 5.1.1, 5.5.0, and 5.5.1 contain insecure permissions for the projector and indexer REST endpoints caused by unauthenticated access, letting attackers access administrative APIs without authentication, exploit require...

CVE-2026-69237

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-69237 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-69237

CVE-2026-69237 is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior . A remote attacker with administrative privileges can insert arbitrary HTML into an administrative API. Esri rates the severity as LOW (CVSS 3.8) , while NVD rates it MEDIUM (4.8) , with the key d...

EUVD-2026-64085

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-69237 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

PT-2026-79470

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.3 Description An HTML injection issue exists that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. HTML injection is a technique where an...

CVE-2026-69237: Improper Neutralization of Input During Web Page Generation

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-60053: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...

PT-2026-65740

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the administrative API used to manage identity providers and organizations. An administrator with permissions to manage identity providers can link a new provider to an...

CVE-2026-18201: Missing Authorization

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the generic identity-provider creation and update paths in...

CVE-2026-17048

The CVE-2026-17048 affects Keycloak’s Admin REST API handling of rotated client secrets stored in a secure vault. The root cause is improper boundary enforcement, allowing a delegated administrator with view-only permissions to retrieve the actual resolved secret instead of the vault placeholder,...

CVE-2026-15945: Authorization Bypass Through User-Controlled Key

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

PT-2026-60541

Name of the Vulnerable Software and Affected Versions Keycloak server affected versions not specified Description A flaw exists in the group search functionality of the administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access...

CVE-2026-35552: Missing Authorization

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's...