EUVD-2026-81336

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...

CVE-2026-85128

The Choose User Role at Registration WordPress plugin (for WooCommerce) before 1.3.3 fails to validate the role requested at registration against the roles an administrator chose to offer. This allows unauthenticated users to request any role—including administrator —and be granted it once the re...

ansible-role-cve-2026-31431

ansible-role-cve-2026-31431 Ansible role to apply and later remove the modprobe.d mitigation for CVE-2026-31431 "Copy Fail" in the Linux kernel's AFALG / algifaead subsystem. Tested on Debian. Pull requests for other distributions, edge cases, or improvements are very welcome. What it does The ro...

CVE-2026-1492

CVE-2026-1492 - Exploit de escalada de privilegios en el plugin de registro de usuarios de WordPress Descripción Este repositorio contiene un exploit de prueba de concepto para CVE-2026-1492 , una vulnerabilidad crítica que afecta al plugin de WordPress User Registration & Membership. La...

CVE-2026-5465

CVE-2026-5465: Privilege Escalation en Plugin Amelia WordPress ⚠️ Resumen Ejecutivo Vulnerabilidad crítica de Referencia Directa Insegura a Objetos IDOR en el plugin Amelia que permite a un usuario autenticado con rol de Empleado Provider escalar privilegios hasta toma de control total Account...

exploit-CVE-2023-3460

title: "Seguridad de los SI - CVE 2023-38408" Análisis y explotación de la CVE-2023-3460 CVE ID| CVSS Score| Discovered| Affected Plugin| Vulnerability Type ---|---|---|---|--- CVE-2023-3460| | 07/04/2023| Ultimate Member| Acceso de Administrador No Autorizado Sumario Introducción Mecanismo gener...

CVE-2026-92772

Leantime before 3.9.6 contains an authorization bypass in the HTMX plugin install endpoint , which lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties—including identifier , version , and license key —to deploy malic...

CVE-2026-92772 Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to depl...

EUVD-2026-81028

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

DB_Audit_Research

Auditorías autodestructivas — laboratorio reproducible Licencia: MIT código / CC BY 4.0 documentación Investigación de seguridad defensiva que comprueba si un rol de base de datos de bajos privilegios y solo inyección puede cegar reversiblemente a un auditor basado en disparadores y envenenar la...

CVE-2026-17526

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

CVE-2026-17526 Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

CVE-2026-17526 Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

CVE-2026-17526

CVE-2026-17526 is a privilege escalation vulnerability in Keycloak (open-source identity and access management), specifically in the keycloak-services component. A user holding the impersonation role can impersonate a realm administrator , gaining full administrative control over the realm—includ...

EUVD-2026-80854

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.16 Security Update

New Red Hat build of Keycloak 26.4.16 packages are available from the Customer Portal Red Hat build of Keycloak 26.4.16 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...