Budibase: Unrestricted Upload of File with Dangerous Type

Summary The file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions html, svg, js, php, etc. are conditionally wrapped inside if isPublicUser or if isPublicUser || !env.SELFHOSTED, meaning an...

Arbitrary File Upload

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Arbitrary File Upload via file upload endpoint POST /api/attachments/process that does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions...

pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This...

GHSA-FHVH-VW7H-9XF3 libcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case

The AVX2 implementation of ML-DSA verification incorrectly implemented the usehint function, mishandling an edge case that should lead to signature rejection. Impact An attacker could make the ML-DSA verifier accept a crafted invalid signature under a maliciously generated verification key, if th...

CVE-2026-45557 Technitium DNS Server excessive DNSSEC requests

Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker in control of a domain can cause a vulnerable system to generate excessive network traffic. Fixed in 15.0...

org.keycloak:keycloak-account-freemarker (1.2.0.beta1), org.keycloak:keycloak-broker-oidc (1.2.0.beta1) +4 more potentially affected by CVE-2026-7504 via org.keycloak:keycloak-services (1.2.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.2.0.beta1 - org.keycloak:keycloak-broker-oidc...

io.github.johnjcool:keycloak-cas-services (4.4.0.final), org.keycloak:keycloak-dependencies-server-min (4.4.0.final) +3 more potentially affected by CVE-2026-7507 via org.keycloak:keycloak-services (4.4.0.final)

org.keycloak:keycloak-services MAVEN version 4.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.4.0.final -...

org.keycloak:keycloak-dependencies-server-all (1.9.3.final), org.keycloak:keycloak-dependencies-server-min (1.9.3.final) +2 more potentially affected by CVE-2026-7507 via org.keycloak:keycloak-services (1.9.3.final)

org.keycloak:keycloak-services MAVEN version 1.9.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.3.final -...

org.keycloak:keycloak-dependencies-server-min (4.0.0.beta1), org.keycloak:keycloak-model-jpa (4.0.0.beta1) +2 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (4.0.0.beta1)

org.keycloak:keycloak-services MAVEN version 4.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.0.0.beta1 - org.keycloak:keycloak-model-jpa...

org.keycloak:keycloak-authz-policy-drools (2.0.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.0.0.cr1) +3 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (2.0.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.0.0.cr1 -...

org.keycloak:keycloak-dependencies-server-all (1.9.3.final), org.keycloak:keycloak-dependencies-server-min (1.9.3.final) +2 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (1.9.3.final)

org.keycloak:keycloak-services MAVEN version 1.9.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.3.final -...

org.keycloak:keycloak-dependencies-server-all (1.9.0.final), org.keycloak:keycloak-dependencies-server-min (1.9.0.final) +2 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (1.9.0.final)

org.keycloak:keycloak-services MAVEN version 1.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.0.final -...

io.github.johnjcool:keycloak-cas-services (4.5.0.final), org.keycloak:keycloak-dependencies-server-min (4.5.0.final) +3 more potentially affected by CVE-2026-7507 via org.keycloak:keycloak-services (4.5.0.final)

org.keycloak:keycloak-services MAVEN version 4.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.5.0.final -...

org.keycloak:keycloak-authz-policy-drools (2.0.0.final), org.keycloak:keycloak-dependencies-server-all (2.0.0.final) +3 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (2.0.0.final)

org.keycloak:keycloak-services MAVEN version 2.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.0.0.final -...

org.keycloak:keycloak-dependencies-server-min (4.2.1.final), org.keycloak:keycloak-model-jpa (4.2.1.final) +2 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (4.2.1.final)

org.keycloak:keycloak-services MAVEN version 4.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.2.1.final - org.keycloak:keycloak-model-jpa...

org.keycloak:keycloak-dependencies-server-min (4.7.0.final), org.keycloak:keycloak-model-jpa (4.7.0.final) +2 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (4.7.0.final)

org.keycloak:keycloak-services MAVEN version 4.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.7.0.final - org.keycloak:keycloak-model-jpa...

org.keycloak:keycloak-authz-policy-drools (3.0.0.final), org.keycloak:keycloak-dependencies-server-all (3.0.0.final) +4 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (3.0.0.final)

org.keycloak:keycloak-services MAVEN version 3.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.0.0.final -...

org.keycloak:keycloak-dependencies-server-all (1.9.2.final), org.keycloak:keycloak-dependencies-server-min (1.9.2.final) +2 more potentially affected by CVE-2026-7507 via org.keycloak:keycloak-services (1.9.2.final)

org.keycloak:keycloak-services MAVEN version 1.9.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.2.final -...

org.keycloak:keycloak-dependencies-server-min (4.8.0.final), org.keycloak:keycloak-model-jpa (4.8.0.final) +2 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (4.8.0.final)

org.keycloak:keycloak-services MAVEN version 4.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.8.0.final - org.keycloak:keycloak-model-jpa...

io.github.johnjcool:keycloak-cas-services (>=4.1.0.final, <=4.1.1.final), org.keycloak:keycloak-dependencies-server-min (4.1.0.final) +3 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (4.1.0.final)

org.keycloak:keycloak-services MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.1.0.final, =4.1.1.final -...