CVE-2026-16443

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

CVE-2026-16102

Keycloak-DCR: The default Dynamic Client Registration policy allows forging roles via User Property mappers due to insufficient claim-path validation. This enables a standard-user with a limited Initial Access Token to write to sensitive internal claim locations, forging administrative roles in t...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-71272

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

CVE-2026-71273

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the webadminpasswordenabled parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click...

Security update for python-Django

This update for python-Django fixes the following issues: CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997. CVE-2026-15337: potential denial-of-service vulnerability in checkforlanguage bsc1272998. CVE-2026-15830: potential denial-of-service vulnerability...

SUSE-SU-2026:3503-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997. - CVE-2026-15337: potential denial-of-service vulnerability in checkforlanguage bsc1272998. - CVE-2026-15830: potential denial-of-service...

CVE-2026-71280 go-shiori - Server-Side Request Forgery via Unrestricted Bookmark URL Fetch

go-shiori's DownloadBookmark internal/core/download.go fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks. An authenticated user creating or updating a...

CVE-2026-71280

go-shiori's DownloadBookmark() (internal/core/download.go) uses a plain http.Client with no DialContext or destination-IP validation, enabling an authenticated user to supply a bookmark URL of 127.0.0.1 or 0.0.0.0 via POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext. Th...

EUVD-2026-53358

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the webadminpasswordenabled parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click...

CVE-2026-71273 OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string...

CVE-2026-71273

OpenBK7231T firmware exposes a CSRF flaw in the /cfg_wifi_set endpoint: configuration changes are accepted via an unauthenticated GET request without a CSRF token. If the web_admin_password_enabled parameter is omitted, an else-branch silently clears the device’s web admin password to an empty st...

CVE-2026-71272

CVE-2026-71272 affects Memos’ webhook dispatch function safeDialContext() in internal/webhook/webhook.go. The code resolves the target hostname with net.DefaultResolver.LookupHost(), validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the origina...

CVE-2026-71271 Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

CVE-2026-71271 Memos - Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does. Becau...

CVE-2026-71270

Stirling-PDF CVE-2026-71270 affects the POST /api/v1/convert/url/pdf endpoint. Unlike its siblings (html/pdf, file/pdf, markdown/pdf), this endpoint was not updated with CustomHtmlSanitizer/SsrfProtectionService SSRF protections. It only validates that the initial URL resolves to a public IP, the...

CVE-2026-71250

Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...

CVE-2026-71247

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler upserts a...

CVE-2026-71235

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...