CVE-2026-97311

A flaw in the Admin REST API of Keycloak , an identity and access management solution, allows for unauthorized information disclosure. Specifically, endpoints used to retrieve groups associated with a specific role fail to properly verify individual group visibility permissions . This vulnerabili...

CVE-2026-54461: Inefficient Regular Expression Complexity

Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a...

CVE-2026-91161: Incorrect Authorization

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/sessionId/groups/groupId/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group...

PT-2026-98186

Name of the Vulnerable Software and Affected Versions Habitica versions 4.172.1 through 5.48.1 Description A query parameter on the '/api/v3/groups/:groupId/members' endpoint is not sanitized before being interpreted as a regular expression. An authenticated caller can provide a computationally...

PT-2026-97547

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the deep-copy permission sanitizer when a WorkflowJobTemplate is copied. The sanitizer validates the inventory, unified job template...

CVE-2026-90990 Livestatus injection via monitoring filter values

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk 2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services...

EUVD-2026-84035

HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any...

PT-2026-96184

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authenticated user can add any other account to a group without requiring an owner role, an invitation token, target-user consent, or notification. This occurs because the endpoint...

sslscan v2.2.3

sslscan2 sslscan version 2 has now been released. This includes a major rewrite of the backend scanning code, which means that it is no longer reliant on the version of OpenSSL for many checks. This means that it is possible to support legacy protocols SSLv2 and SSLv3, as well as supporting TLSv1...

CLEANSTART-2026-ZE25949 flaw was found in the default-groups REST endpoint and realm representation of Keycloak

Security vulnerability affects the keycloak package. A flaw was found in the default-groups REST endpoint and realm representation of Keycloak...

Incorrect Privilege Assignment

Overview anyio is a High level compatibility layer for multiple asynchronous event loop implementations Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the openprocess function in src/anyio/core/subprocesses.py, where the extragroups parameter is silently...

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...

EUVD-2026-83191

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...

CVE-2026-12954

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954

The Mapster WP Maps WordPress plugin (≤ 1.23.0) is vulnerable to Arbitrary User Meta Write via the my_profile_update() function. The function performs no nonce verification, capability check, or allowlist validation on the meta key supplied through the acf-photo-gallery-groups POST parameter befo...

CVE-2026-12954 Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

EUVD-2026-82756

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954 Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954: Improper Input Validation

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-81626: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the...