CVE-2026-69693

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

BIT-KEYCLOAK-2026-3009 Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider IdP even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the...

CVE-2026-66782 Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

CVE-2026-66782: Improper Privilege Management

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

CVE-2026-49434

A flaw was found in Apache ActiveMQ. An attacker with privileges to publish or modify entries in Lightweight Directory Access Protocol LDAP can exploit an improper input validation vulnerability. This allows the attacker to instantiate denied transports within the broker's Java Virtual Machine JV...

External Control of System or Configuration Setting

Overview org.apache.activemq:activemq-all is a package that puts together an ActiveMQ jar bundle. Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the LdapNetworkConnector process. An attacker can instantiate unauthorized transports and...

BIT-ACTIVEMQ-2026-34197 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

GHSA-9Q5M-JFC4-WC92 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

Summary All three OAuth service implementations GenericOAuthService, GithubOAuthService, GoogleOAuthService store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the IdentityBrokerService.performLogin endpoint. An...

CVE-2026-3009

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider IdP even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the...

CVE-2025-55677

CVE-2025-55677 affects the Windows Device Association Broker service and is caused by an untrusted pointer dereference that enables local elevation of privileges for an authenticated user. Microsoft corresponding fix is in KB5066835 (OS builds 26200.6899 and 26100.6899); applying these updates re...

CVE-2025-55677 Windows Device Association Broker Service Elevation of Privilege Vulnerability

...

CVE-2025-50174

CVE-2025-50174 is a use-after-free in the Windows Device Association Broker service that enables a local attacker to escalate privileges. Affected platforms include Windows OS versions addressed by KB5066835 (OS builds 26200.6899 and 26100.6899). Root cause: use-after-free in the broker service; ...

EUVD-2025-34429

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

Windows Device Association Broker Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

Windows Device Association Broker Service Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

CVE-2025-61779 Trustee's attestation-policy endpoint is not protected by admin autentication

Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated had the right key...

EUVD-2025-4908

Malicious code in bioql PyPI...

CVE-2024-37600

An issue was discovered in Mercedes Benz NTG New Telematics Generation 6 through 2021. A possible stack buffer overflow in the Service Broker service affects NTG 6 head units. To perform this attack, physical access to Ethernet pins of the head unit base board is needed. With a static IP address,...

CVE-2024-37600: Stack-based Buffer Overflow

An issue was discovered in Mercedes Benz NTG New Telematics Generation 6 through 2021. A possible stack buffer overflow in the Service Broker service affects NTG 6 head units. To perform this attack, physical access to Ethernet pins of the head unit base board is needed. With a static IP address,...