CVE-2026-4912

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...

CVE-2026-4912 Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...

CVE-2026-4912 Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...

Security update for sssd

This update for sssd fixes the following issue: CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free bsc1269807. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +241 more potentially affected by CVE-2026-18201 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.5)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18201 Source advisory: SNYK:JAVA-ORGKEYCLOAK-19006721...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +211 more potentially affected by CVE-2026-18206 via org.keycloak:keycloak-services (>=12.0.0, <=26.7.5)

org.keycloak:keycloak-services MAVEN version =12.0.0, =0.1.0, =3.1.13-jdk1.8, =12.0.0, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18206 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18751614...

DNS Rebinding

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to DNS Rebinding in the client host restriction logic. An attacker can bypass wildcard domain restrictions on...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +241 more potentially affected by CVE-2026-18208 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.5)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18208 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18751971...

Improper Validation of Consistency within Input

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input during OIDC authentication flow processing. An attacker can...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (26.7.3.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (26.7.3.0) +106 more potentially affected by CVE-2026-18209 via org.keycloak:keycloak-services (>=26.5.0, <=26.7.2)

org.keycloak:keycloak-services MAVEN version =26.5.0, =1.0.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.4.0 and more Source cves: CVE-2026-18209 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18751613https:...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (26.7.3.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (26.7.3.0) +89 more potentially affected by CVE-2026-18211 via org.keycloak:keycloak-services (>=26.7.0, <=26.7.5)

org.keycloak:keycloak-services MAVEN version =26.7.0, =6.0.0, =6.0.0, =2.8.4, =3.0.0, =0.7.0, =2.3.0, =1.11.30, =1.3.0, =0.3.0, =0.1.3, =1.3.0, =1.4.0 - io.github.hqqw2h-lgtm:keycloak-services-social-wecom 0.1.0 and more Source cves: CVE-2026-18211 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18751612...

SUSE-SU-2026:3368-1 Security update for sssd

This update for sssd fixes the following issue: - CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free bsc1269807...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the Google token exchange flow in the Google Identity Provider token exchange...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +221 more potentially affected by CVE-2026-18214 via org.keycloak:keycloak-services (>=3.4.0.cr1, <=26.7.2)

org.keycloak:keycloak-services MAVEN version =3.4.0.cr1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18214 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752077...

Improper Authentication

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Authentication through the Microsoft account token exchange flow in the Microsoft identity provider...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +221 more potentially affected by CVE-2026-18215 via org.keycloak:keycloak-services (>=3.4.0.cr1, <=26.7.2)

org.keycloak:keycloak-services MAVEN version =3.4.0.cr1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18215 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752074...

YeaLink DM 3.6.0.20 - Remote Command Injection Detection

Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Yealink Device Management DM 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Utility Services Administration - Detect

Detects Utility Services Administration - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Utility Services Administration - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Utility Services...

ArcGIS REST Services Directory - Detect

Check for the existence of the "/arcgis/rest/services" path on an ArcGIS server. !/usr/bin/env python3 -- coding: utf-8 -- """Check for the existence of the "/arcgis/rest/services" path on an ArcGIS server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...