CVE-2026-112908

The filelock library for Python (versions 3.30.0 through 4.2.1) contains a vulnerability in its StrictSoftFileLock and AsyncStrictSoftFileLock components on POSIX systems. The root cause is that these components create coordination and claim directories without applying the caller’s restrictive l...

CVE-2026-112938

The filelock Python library (versions 3.30.0 through 4.2.1 ) is vulnerable to a race condition on POSIX platforms. In StrictSoftFileLock and AsyncStrictSoftFileLock , a local account can rename a coordination name to swap in a symbolic link between the directory validation check and the subsequen...

CVE-2026-97847

A vulnerability exists in the protocol mapper and identity resolution components of Keycloak . The flaw allows a client manager to use hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Since these tokens lack a session ID, Keycloak may incorrectly resolve ...

CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority

A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve t...

CVE-2026-92857 Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their o...

CVE-2026-92857

The Keycloak-services Dynamic Client Registration (DCR) feature contains a vulnerability where protocol mapper configurations are not validated . This flaw allows individuals holding specific tokens to register malicious applications and map their own profile details to protected fields, such as ...

distributed-system-testing

Distributed Systems Testing Skills Two skills for AI coding agents that design and run claim-driven tests for distributed and stateful systems. Together they produce a structured Markdown test plan and a findings report with 10-state verdicts and an explicit SUT / harness / checker / environment...

CVE-2026-123010

@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set...

CVE-2026-123010

The @twilio-labs/netlify-okta-auth library (versions through 1.0.2 ) is vulnerable because it relies on an unverified iss claim . This flaw impacts an outbound HTTP request used to retrieve a public signing key. Additionally, there may be further impacts if the oktaUrl is left unset due to miscon...

EUVD-2026-117323

@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set...

CVE-2026-62662

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidcservice.go accepts the client-controlled resource parameter and embeds it directly in the access token aud...

CVE-2026-121442

Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to othe...

CVE-2026-121442

Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to othe...

EUVD-2026-115864

Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to othe...

CVE-2026-121442

Frappe HRMS versions before 15.61.0 are affected by a permission bypass vulnerability (CWE-639) within the Expense Claim Advances API . Due to improper authorization checks, authenticated employees can query the API to retrieve expense advance records belonging to other employees. This flaw leads...

CVE-2026-121442 Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API

Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to othe...

CVE-2026-121442: frappe hrms: Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other…

Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to othe...

SD JWT JS: Tampered disclosures silently dropped instead of rejected

Summary When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed sd array, @sd-jwt/decode 0.19.0 does not reject the presentation. It silently drops the unmatched Disclosure and returns a reduced claim set, reporting success. The Issuer signature...

EUVD-2026-113215

SD JWT JS: Tampered disclosures silently dropped instead of rejected...

GHSA-F9J6-8P6X-R9J6 SD JWT JS: Tampered disclosures silently dropped instead of rejected

Summary When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed sd array, @sd-jwt/decode 0.19.0 does not reject the presentation. It silently drops the unmatched Disclosure and returns a reduced claim set, reporting success. The Issuer signature...