CVE-2026-18203

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...

CVE-2026-18203

CVE-2026-18203 describes a flaw in Keycloak’s group policy evaluation logic: when a group policy is configured to extend permissions to child groups, the system uses a simple text-based prefix check to verify membership. This allows a user from a different group with a similar starting name to by...

CVE-2026-18203

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...

PT-2026-66722

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the group policy evaluation logic of Keycloak. When a group policy is configured to extend permissions to child groups, the system employs a simple text-based prefix check t...

CVE-2026-62246

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema and GetDefaultDatastoreUsername, allowing distinct...

EUVD-2026-51311

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema and GetDefaultDatastoreUsername, allowing distinct...

CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

CVE-2026-6540

Technical details about CVE-2026-6540 are not publicly available in the provided documents. Monitor for updated advisories for affected products, impact scope, and remediation guidance.

CVE-2026-6540

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Summary OliveTin's checkShellArgumentSafety function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex, any Shell mode action using a regex:-typed argument...

ALPINE-CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-15144

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range a /64 holds 2^64 distinct addresses and the same address has multiple valid textual representations, an IPv6 capable...

EUVD-2026-36072

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape...

DEBIAN-CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding

A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...

CVE-2026-55554 Dompdf: Chroot Validation Bypass

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554

CVE-2026-55554 affects Dompdf (PHP HTML-to-PDF converter). The issue stems from validateLocalUri() using a realpath()-based normalization and a prefix strpos() check to enforce chroot boundaries. Because trailing directory separators are stripped during normalization, a defined chroot like /var/w...

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-66754 Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...