70567 matches found
CLEANSTART-2026-CJ40397 flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component
Security vulnerability affects the keycloak package. A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component...
CLEANSTART-2026-AH74122 Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication
Security vulnerability affects the keycloak package. Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication...
CLEANSTART-2026-EU32419 It was identified that the LDAP client implementation in version 2
Security vulnerability affects the keycloak package. It was identified that the LDAP client implementation in version 2...
How to Comply with MiCA Regulations for Crypto Asset Service Providers in the European Market?
MiCA compliance requires crypto firms entering the EU to address authorization, governance, capital, client asset protection and ongoing reporting requirements...
CVE-2026-93999: Missing Authorization
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...
PT-2026-95821
Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to commit bad75bddc74d12d36cfb843f4531d3b830a8d994 Description The tracking API fails to verify the cryptographic hash of the client secret before authorizing bot filtering and revenue events. An attacker possessing on...
PT-2026-95825
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the OpenID Connect OIDC protocol implementation. During the token refresh process, the server restores requested audiences from stored client IDs but fails to verify if the...
CVE-2026-11727
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...
CVE-2026-77528
Autobahn Python (a WebSocket and WAMP implementation for Python supporting Twisted and asyncio) contains a vulnerability prior to version 26.7.1 in its permessage-deflate handling. When a WebSocket endpoint enforces maxMessagePayloadSize , the limit is checked against the compressed frame length ...
CVE-2026-11727 IBM MQ for HPE NonStop is vulnerable to a denial of service issue
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...
CVE-2026-11727 IBM MQ for HPE NonStop is vulnerable to a denial of service issue
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...
EUVD-2026-83294
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...
CVE-2026-11727
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 and IBM MQ 9.1 through 10.0.0.0 (Standard Client) are affected by a heap-based buffer overflow (CWE-122) in the MQ client's MQOPEN reply handler . Improper validation of queue manager responses when requesting AMS policy data allows a rogue queue mana...
Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion
Summary In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external redirect URI, and the authorization flow would auto-complete without a consent screen. If a logged-in victim visited a crafted authorization URL, an authorization code was delivered...
CVE-2026-93750
http-cache-semantics (npm) through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients and receive cached respons...
CVE-2026-93750 http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...
CVE-2026-77239
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...
EUVD-2026-83178
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...
CVE-2026-10751 IBM MQ Java messaging is vulnerable to remote code execution
IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling...