EUVD-2026-61063

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-57580

In authentik versions before 2026.2.6 and 2026.5.5, an inbound SAML Source using USERNAME_LINK or EMAIL_LINK matching interprets XML comments in a NameID differently than the signed assertion. An attacker who can set their NameID can inject a comment to truncate the value to a victim's username/e...

CVE-2026-54730 authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

How to Spot and Stop Rogue Device Joins

Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attack...

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

CVE-2026-50575

BetterDesk versions through 2.3.0 fail to invalidate deleted device identities, letting an unauthenticated client replay or spoof a device ID to bypass registration controls. CVSS 7.7 (HIGH) reflects network exposure with no privileges required. Version 3.0.0-alpha patches the issue; no workaroun...

CVE-2026-50575 BetterDesk has a replay behavior vulnerability when devices are deleted

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

EUVD-2026-60763

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

PT-2026-77216

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw in the reset-credentials flow of the keycloak-services component allows an unauthenticated attacker to bypass the email verification requirement during the password...

PT-2026-78240

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.9 Description An authenticated user can modify backend-managed identity attributes via the 'PATCH /api/users/:id' endpoint. This occurs because the whitelist in the update.js controller allows mass assignment of...

PT-2026-78098

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: Installer. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager...

CVE-2026-18674

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

EUVD-2026-60160

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674

Kong Mesh multi-zone deployments are vulnerable in the zone-to-global KDS sync: the global control plane trusts an in-band, sender-controlled ControlPlane.Identifier instead of the authenticated TLS zone identity. This allows any authenticated zone to inject, attribute, and overwrite resources in...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-74876 openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

BIT-NODE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

BIT-NODE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...