CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

EUVD-2026-61063

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963

A critical flaw in the reset-credentials flow of Keycloak 26.0.0–26.7.1 allows an unauthenticated attacker to force a password reset for any user—including administrators—without clicking the required email verification link, enabling full account takeover . The root cause involves two chained de...

SUSE CVE-2026-68133

In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICEPTPUNINIT, then iceptprebuild will update the state to ICEPTPERROR. This will result in the following PTP release call trace during driver...

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

GO-2026-6244 New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api

New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...

SUSE CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

PT-2026-77216

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 26.7.2 Red Hat Build of Keycloak versions 26.4.x prior to 26.4.15 Red Hat Build of Keycloak versions 26.6.x prior to 26.6.6 Description A flaw exists in the reset-credentials flow of the keycloak-services component d...

PT-2026-80461

New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

Linux Distros Unpatched Vulnerability : CVE-2026-74357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of- bounds in amdgpucoredump ring dump The ring content dump ...

Linux Distros Unpatched Vulnerability : CVE-2026-68475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - reset: sunxi: fix memory region leak on ioremap failure In sunxiresetinit, when ioremap fails, the memory region obtained via requestmemregion is not released,...

Linux Distros Unpatched Vulnerability : CVE-2026-72425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ice: fix FDIR CTRL VSI resource leak in iceresetallvfs Resetting all VFs causes resource leak on VFs with FDIR filters enabled as CTRL VSIs are only invalidated...

Linux Distros Unpatched Vulnerability : CVE-2026-74416

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/radeon: fix memory leak in radeonringrestore on lock failure radeonringrestore takes ownership of the data buffer allocated by radeonringbackup. The caller...

CVE-2026-75103

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

GHSA-P845-629J-RCJ6 New API: Admin can reset passkeys for same-level or higher-privileged users

Summary The admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints. A lower-privileged administrator could attempt passkey reset operations against same-level or higher-privileged users, including root-level accounts. Impa...

New API: Admin can reset passkeys for same-level or higher-privileged users

Summary The admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints. A lower-privileged administrator could attempt passkey reset operations against same-level or higher-privileged users, including root-level accounts. Impa...