org.keycloak:keycloak-account-freemarker (1.2.0.beta1), org.keycloak:keycloak-broker-oidc (1.2.0.beta1) +4 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.2.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.2.0.beta1 - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-account-freemarker (1.0-rc-2), org.keycloak:keycloak-dependencies-server-all (1.0-rc-2) +3 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.0-rc-2)

org.keycloak:keycloak-services MAVEN version 1.0-rc-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-rc-2 - org.keycloak:keycloak-dependencies-server-al...

org.keycloak:keycloak-account-freemarker (1.0-beta-2), org.keycloak:keycloak-login-freemarker (1.0-beta-2) potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.0-beta-2)

org.keycloak:keycloak-services MAVEN version 1.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-2 - org.keycloak:keycloak-login-freemarker...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.final), org.keycloak:keycloak-account-freemarker (1.0-rc-1) +4 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.0-rc-1)

org.keycloak:keycloak-services MAVEN version 1.0-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1), org.keycloak:keycloak-account-freemarker (1.0-beta-3) +1 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.0-beta-3)

org.keycloak:keycloak-services MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =0.11.0, =1.0.0.beta1 -...

org.keycloak:keycloak-account-freemarker (1.0-beta-1), org.keycloak:keycloak-login-freemarker (1.0-beta-1) potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.0-beta-1)

org.keycloak:keycloak-services MAVEN version 1.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-1 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.1.0.beta1), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta1) +1 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.1.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta1 -...

org.keycloak:keycloak-account-freemarker (1.1.0.beta2), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta2) +1 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.1.0.beta2)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta2 -...

org.keycloak:keycloak-account-freemarker (1.0-alpha-3), org.keycloak:keycloak-login-freemarker (1.0-alpha-3) +1 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.0-alpha-3)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-3 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.0-beta-1-20150523), org.keycloak:keycloak-login-freemarker (1.0-beta-1-20150523) +1 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.0-beta-1-20150523)

org.keycloak:keycloak-services MAVEN version 1.0-beta-1-20150523 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-1-20150523 -...

org.keycloak:keycloak-account-freemarker (1.0-beta-1-20150521), org.keycloak:keycloak-login-freemarker (1.0-beta-1-20150521) +1 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.0-beta-1-20150521)

org.keycloak:keycloak-services MAVEN version 1.0-beta-1-20150521 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-1-20150521 -...

org.keycloak:keycloak-account-freemarker (1.0-alpha-2), org.keycloak:keycloak-login-freemarker (1.0-alpha-2) +1 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (1.0-alpha-2)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-2 - org.keycloak:keycloak-login-freemarker...

GHSA-4J6X-2764-M8GH Rancher has over-inclusive team membership expansion in GitHub App authentication provider

Impact A vulnerability has been identified within Rancher Manager in the GitHub App authentication provider. When evaluating permissions, the provider incorrectly expands user team memberships to include all teams within the associated GitHub organization, rather than restricting access to the...

GHSA-M492-GV72-XVXJ Kimai Password Reset Link Remains Valid After Password Change

Summary The LoginLink signature used for password reset URLs covers only the user's id — it does not include the password hash. After a user clicks a reset link and successfully changes their password, the same link remains valid for up to 2 additional uses within a 1-hour window. Anyone who...

GHSA-8W27-C4VC-88Q9 Concourse login flow has an open redirect issue

Impact An attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. Patches This has been fixed in 8.2.3 Workarounds None. Exploit Vulnerable code was in:...

CVE-2026-13769

Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most systems may allow other local users on the same host to read credentials written by certain CLI subcommands...

WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by ParkHyunWoo in WordPress Plugin Heateor Social Login versions = 1.1.39...

CVE-2026-13228 LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference IDOR in the createorupdate function of OsOrdersController, whi...

CVE-2026-50043

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in SkyBridge MB-A100/MB-A110. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product with an administrative privilege...

CVE-2026-50043

SkyBridge MB-A100/MB-A110 are affected by CVE-2026-50043: improper neutralization of special elements used in an OS command (OS Command Injection). If an attacker can log in with administrative privileges, arbitrary OS commands may be executed. The connected documents do not specify a patch or wo...