54147 matches found
ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +210 more potentially affected by CVE-2026-18218 via org.keycloak:keycloak-services (>=9.0.0, <=26.7.2)
org.keycloak:keycloak-services MAVEN version =9.0.0, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.2.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18218 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752084...
CVE-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...
Authorization Bypass Through User-Controlled Key
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the getRoleUserMembers path in RoleContainerResource...
ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +205 more potentially affected by CVE-2026-17059 via org.keycloak:keycloak-services (>=12.0.0, <=26.7.2)
org.keycloak:keycloak-services MAVEN version =12.0.0, =0.1.0, =3.1.13-jdk1.8, =12.0.0, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-17059 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752090...
Authentication Bypass
LiteLLM is vulnerable to Authentication Bypass. The vulnerability is due to improper handling of the MCP authentication fallback path, where failed LiteLLM key validation is replaced with an empty authentication object, which allows an unauthenticated attacker to exploit the MCP Streamable HTTP...
OESA-2026-3151 sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...
OESA-2026-3149 sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...
OESA-2026-3150 sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...
OESA-2026-3147 sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...
CVE-2026-15704 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components
In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...
PT-2026-64299
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the role-users endpoint of the keycloak-services library. The system fails to verify if an administrator has the necessary permissions to view individual users when listing...
CVE-2026-17059: Authorization Bypass Through User-Controlled Key
A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...
CVE-2026-8308: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS. This issue affects Website Template: before v2...
CVE-2026-63313
9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...
CVE-2026-48013
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the "/api/action/media/external-link" endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel "uploadFromURL" flow validates target IPs against...
CVE-2026-16584 AWS API MCP Server Security Policy Bypass via Startup Failure
Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data...
Azure Portal Information Disclosure Vulnerability
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...
openjdk: Enhance XBM image support (Oracle CPU 2026-07)
A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...
Astra Linux – vulnerability in Chromium
The use of “after free” in Chromoting in Google Chrome prior to version 147.0.7727.138 allowed a remote attacker to execute arbitrary code via malicious network traffic. Chromium security severity: High...
