org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.5), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.5) +36 more potentially affected by CVE-2026-42797 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.0.0-m0, <=4.0.5)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.5 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.0), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.0) +36 more potentially affected by CVE-2026-42797 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.1.0-m0, <=4.1.0)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0 and more Source cves:...

Linux Distros Unpatched Vulnerability : CVE-2026-21724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify...

SUSE CVE-2026-21724

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission...

io.phasetwo.keycloak:keycloak-extensions (0.1), net.optionfactory.keycloak:optionfactory-keycloak-provisioning-api (4.0) +7 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-model-jpa (22.0.3)

org.keycloak:keycloak-model-jpa MAVEN version 22.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - io.phasetwo.keycloak:keycloak-extensions 0.1 -...

io.phasetwo.keycloak:keycloak-orgs (>=0.58, <=0.66), net.optionfactory.keycloak:optionfactory-keycloak-provisioning-api (5.3) +7 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-model-jpa (23.0.7)

org.keycloak:keycloak-model-jpa MAVEN version 23.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - io.phasetwo.keycloak:keycloak-orgs =0.58, =0.66 -...

CVE-2026-21724

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission...

CVE-2026-21724

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission...

CVE-2026-21724

Grafana OSS vulnerability CVE-2026-21724: a flaw in the Provisioning Contact Points API allows users with Editor role to bypass authorization and modify protected webhook URLs without the alert.notifications.protected:write permission. Impact is limited to unauthorized changes to protected webhoo...

CVE-2026-32130

ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a System for Cross-domain Identity Management SCIM API to provision users from external providers into Zitadel. Request to the API with URL-encoded path values were correctly routed bu...

PT-2026-28321

Name of the Vulnerable Software and Affected Versions Grafana OSS versions prior to 12.3.6 Description An authorization bypass exists in the provisioning contact points API. This issue allows users with the Editor role to modify protected webhook URLs without possessing the necessary...

Missing Protected-field Authorization in Provisioning Contact Points API

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission...

EUVD-2023-2361

Malicious code in bioql PyPI...

CVE-2024-52505

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in...

CVE-2024-52505 matrix-appservice-irc allows IRC Command injection in provisioning API

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in...

CVE-2024-52505

CVE-2024-52505 affects the matrix-appservice-irc Node.js IRC bridge. The provisioning API in versions up to 3.0.2 allowed arbitrary IRC command execution by the bridge bot, as described in multiple sources. A fix exists in version 3.0.3, which patches the vulnerability. No exploitation details ar...

CVE-2024-52505 matrix-appservice-irc allows IRC Command injection in provisioning API

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in...

CVE-2024-52505 matrix-appservice-irc allows IRC Command injection in provisioning API

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in...

CVE-2024-52505

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in...

CVE-2024-52505: Improper Neutralization of Input Terminators

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in...