CVE-2026-33807 @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time,...

PT-2026-33034

Name of the Vulnerable Software and Affected Versions @fastify/express versions prior to 4.0.5 Description A path handling bug in the onRegister function causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix matching a middleware...

WordPress plugin Magazine Blocks has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

WordPress plugin Tutor LMS has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

(0Day) Docker Desktop cli-plugins Incorrect Permission Assignment Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop for Windows. An attacker must first obtain the ability to escape the container and execute low-privileged code within the Docker Hyper-V VM in order to exploit this vulnerability. The...

com.github.vzakharchenko:keycloak-plugins (1.0.2), com.github.vzakharchenko:mikrotik-radius-plugin (1.0.2) +12 more potentially affected by CVE-2026-37980 via org.keycloak:keycloak-services (8.0.2)

org.keycloak:keycloak-services MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.0.2 - com.github.vzakharchenko:mikrotik-radius-plugin...

com.github.vzakharchenko:keycloak-plugins (>=1.1.0, <=1.2.0), com.github.vzakharchenko:mikrotik-radius-plugin (>=1.1.0, <=1.2.0) +12 more potentially affected by CVE-2026-37980 via org.keycloak:keycloak-services (9.0.0)

org.keycloak:keycloak-services MAVEN version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:keycloak-plugins =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.2.0 -...

com.github.vzakharchenko:keycloak-plugins (1.2.2), com.github.vzakharchenko:mikrotik-radius-plugin (1.2.2) +13 more potentially affected by CVE-2026-37980 via org.keycloak:keycloak-services (9.0.2)

org.keycloak:keycloak-services MAVEN version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.2.2 - com.github.vzakharchenko:mikrotik-radius-plugin...

com.github.vzakharchenko:keycloak-plugins (1.2.4), com.github.vzakharchenko:mikrotik-radius-plugin (1.2.4) +12 more potentially affected by CVE-2026-37980 via org.keycloak:keycloak-services (10.0.1)

org.keycloak:keycloak-services MAVEN version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.2.4 - com.github.vzakharchenko:mikrotik-radius-plugin...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.8, <=1.3.9), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.8, <=1.3.9) +23 more potentially affected by CVE-2026-37980 via org.keycloak:keycloak-services (14.0.0)

org.keycloak:keycloak-services MAVEN version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.11), com.github.vzakharchenko:cisco-radius-plugin (1.3.11) +25 more potentially affected by CVE-2026-37980 via org.keycloak:keycloak-services (15.0.1)

org.keycloak:keycloak-services MAVEN version 15.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.11 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.15), com.github.vzakharchenko:cisco-radius-plugin (1.3.15) +24 more potentially affected by CVE-2026-37980 via org.keycloak:keycloak-services (15.1.0)

org.keycloak:keycloak-services MAVEN version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.15 -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.0, <=1.4.2), com.github.vzakharchenko:cisco-radius-plugin (>=1.4.0, <=1.4.2) +26 more potentially affected by CVE-2026-37980 via org.keycloak:keycloak-services (17.0.0)

org.keycloak:keycloak-services MAVEN version 17.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0,...

com.charlyghislain.keycloak:keycloak-importexport (19.0.0), com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.7, <=1.4.8) +32 more potentially affected by CVE-2026-37980 via org.keycloak:keycloak-services (19.0.1)

org.keycloak:keycloak-services MAVEN version 19.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport 19.0.0 -...

RHSA-2026:7850 Red Hat Security Advisory: gstreamer-plugins-base and gstreamer-plugins-good security update

Bulletin has no description...

Debian: Security Advisory (DLA-4530-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 44 Update: OpenImageIO-3.1.12.0-2.fc44

OpenImageIO is a library for reading and writing images, and a bunch of relat ed classes, utilities, and applications. Main features include: - Extremely simple but powerful ImageInput and ImageOutput APIs for reading a nd writing 2D images that is format agnostic. - Format plugins for TIFF,...

[SECURITY] Fedora 44 Update: kf5-kimageformats-5.116.0-8.fc44

This framework provides additional image format plugins for QtGui. As such it is not required for the compilation of any other software, but may be a runtime requirement for Qt-based software to support certain image formats...

[SECURITY] [DLA 4530-1] gst-plugins-bad1.0 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4530-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz April 13, 2026 https://wiki.debian.org/LTS -...

Important: Red Hat Security Advisory: gstreamer-plugins-base and gstreamer-plugins-good security update

An update for multiple packages is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...