EUVD-2026-60581

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in...

CVE-2026-19608 Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in...

CVE-2026-19608

A flaw in the group policy provider of Keycloak authorization services allows unauthorized access to protected resources. The root cause is that group-based policy evaluation uses tokens containing only group names rather than full paths . When two groups in different parts of the organization hi...

CVE-2026-19608

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in...

PT-2026-77144

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the governance-policy-addon-controller component allows a user with permissions to annotate the namespaced ManagedClusterAddOn resource to...

MiracleLinux 8 : firefox-140.13.0-1.el8_10.ML.1 (AXSA:2026-1560:19)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1560:19 advisory. libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue i...

PT-2026-77007

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 115.39 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to...

Linux Distros Unpatched Vulnerability : CVE-2026-72457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: fail policy unpack on accept2 allocation failure unpackpdb may need to allocate a missing ACCEPT2 table for older policy data. If that allocation...

PT-2026-76989

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A same-origin policy bypass exists within the DOM: Service Workers component. The same-origin...

PT-2026-76996

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird ESR versions prior to 140.14 Thunderbird ESR versions prior to 153.1 Description A same-origin...

PT-2026-77328

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description An information leak in Skia allows a remote attacker to potentially bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from one...

RLSA-2026:55437 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

EUVD-2025-210733

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27621 UpTrain has a Constant Default API Key

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27621

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2026-55674 Discourse: Cache poisoning/XSS via color scheme cookies

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted colorschemeid or darkschemeid cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered...

CVE-2026-15754

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-15754 Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-15754 Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-15754

Mattermost 11.7.x (≤11.7.6) and 11.8.x (≤11.8.3) have a missing per-channel team-scope check in the ABAC policy unassign endpoint, allowing an authenticated team administrator to remove ABAC policy assignments from channels that have been moved to another team. Impact is integrity-focused (CVSS 4...