CVE-2026-53383 ksmbd: reject non-VALID session in compound request branch

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

OESA-2026-3011 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. oidcstatecookiesparsetoken src/state.c scans a...

OESA-2026-3009 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. oidcstatecookiesparsetoken src/state.c scans a...

OESA-2026-3012 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. oidcstatecookiesparsetoken src/state.c scans a...

CVE-2026-63828: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg/sendto with MSGFASTOPEN is a combination of connect2 and write2: it opens the connection in the SYN. apparmorsocketsendmsg only checks AAMAYSEND, so a profil...

CVE-2026-63094

SigNoz up to version 0.133.0 contains an open redirect in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from users on instances configured with Google OAuth, SAML, or OIDC. An attacker can call the unauthenticated sessions context endpoint with a ref pa...

EUVD-2026-45177

SigNoz through 0.133.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with...

CVE-2026-63094

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

Uncontrolled Resource Consumption

github.com/forgekeep/nebula-mesh is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the unauthenticated /ui/oidc/login endpoint creating and storing a new OIDC state for every request without rate limiting or a maximum state limit, which allows an attacker to repeated...

CVE-2026-15943

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

CVE-2026-15943

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

CVE-2026-15943

A vulnerability in Keycloak's keycloak-services component affects identity provider management. When a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value, the system performs improper validation and reuses the existing real secret even if fields ...

CVE-2026-15943 Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

EUVD-2026-45164

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

CVE-2026-15943 Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

@0xwork/connect (0.1.8), @openclaw/kitchen-sink (0.2.6) potentially affected by CVE-2026-62221 via openclaw (>=2026.5.20, <=2026.5.24-beta.2)

openclaw NPM version =2026.5.20, =2026.5.24-beta.2 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @0xwork/connect 0.1.8 - @openclaw/kitchen-sink 0.2.6 Source cves: CVE-2026-62221 Source advisory: SNYK:JS-OPENCLAW-180178...

@0xwork/connect (0.1.8), @openclaw/kitchen-sink (0.2.6) potentially affected by CVE-2026-62217 via openclaw (>=2026.5.20, <=2026.5.24-beta.2)

openclaw NPM version =2026.5.20, =2026.5.24-beta.2 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @0xwork/connect 0.1.8 - @openclaw/kitchen-sink 0.2.6 Source cves: CVE-2026-62217 Source advisory: SNYK:JS-OPENCLAW-180178...

PT-2026-60741

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the keycloak-services component responsible for identity provider management. The issue occurs when a delegated administrator updates an OIDC identity provider using a maske...