Cross-site Scripting (XSS)

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the client URI validation process. An attacker can execute arbitrary scripts in...

com.inventage.keycloak.log-level:keycloak-log-level (1.0.0), com.inventage.keycloak.role-based-timeout:keycloak-role-based-timeout (>=1.0.0, <=1.2.0) +92 more potentially affected by CVE-2026-9086 via org.keycloak:keycloak-services (>=26.5.0, <=26.6.3)

org.keycloak:keycloak-services MAVEN version =26.5.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.11.17, =1.1.2, =1.2.7 and more Source cves: CVE-2026-9086 Source advisory: SNYK:JAVA-ORGKEYCLOAK-17817224https://vulners.com/snyk/SNYK:JAVA-ORGKEYCLOAK-1...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +101 more potentially affected by CVE-2026-9086 via org.keycloak:keycloak-services (>=26.0.0, <=26.4.7)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =1.1.1-26.0, =0.1.0, =1.4.0 and more Source cves: CVE-2026-9086 Source advisory: SNYK:JAVA-ORGKEYCLOAK-17817224...

Directory Traversal

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Directory Traversal via the keystore parameter when creating a key provider component. An attacker can...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +101 more potentially affected by CVE-2026-9083 via org.keycloak:keycloak-services (>=26.0.0, <=26.4.7)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =1.1.1-26.0, =0.1.0, =1.4.0 and more Source cves: CVE-2026-9083 Source advisory: SNYK:JAVA-ORGKEYCLOAK-17817227...

com.inventage.keycloak.log-level:keycloak-log-level (1.0.0), com.inventage.keycloak.role-based-timeout:keycloak-role-based-timeout (>=1.0.0, <=1.2.0) +92 more potentially affected by CVE-2026-9083 via org.keycloak:keycloak-services (>=26.5.0, <=26.6.3)

org.keycloak:keycloak-services MAVEN version =26.5.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.11.17, =1.1.2, =1.2.7 and more Source cves: CVE-2026-9083 Source advisory: SNYK:JAVA-ORGKEYCLOAK-17817227https://vulners.com/snyk/SNYK:JAVA-ORGKEYCLOAK-1...

CVE-2026-12318

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Libraries component in NSS...

Oracle Linux 9 : firefox (ELSA-2026-27734)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-27734 advisory. 140.12.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding R...

PT-2026-52543

Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal...

PT-2026-52548

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download url parameters. Attackers with default workspace USER role can...

Oracle WebLogic Server Unauthorized Access

The vulnerability of the Web Services component of the Oracle WebLogic Server application server is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through HTTP...

Malicious code in leo-auth (npm)

The leo-auth npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6419 Malicious code in leo-cache (npm)

The leo-cache npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

CVE-2026-55455 Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils used by the REST API and GraphQL datasource plugins validates hosts against an exact-match string denylist. The comprehensive address-class check...

CVE-2026-55455

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils used by the REST API and GraphQL datasource plugins validates hosts against an exact-match string denylist. The comprehensive address-class check...

CVE-2026-41000

A flaw was found in Spring Web Services. The security interceptor in the affected component did not properly integrate replay cache mechanisms. This vulnerability could allow a remote attacker to bypass replay protections for security tokens, such as UsernameToken nonces and SAML one-time-use...

CVE-2026-53944

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. This vulnerability is fixed in...

CVE-2026-53944

Affected software: Ghost CMS (Node.js) versions 6.0.9 through 6.21.1. Vulnerability: When Ghost makes an external request, an IPv6 literal can map to a private IPv4 address, bypassing the internal IP filter and potentially reaching internal services. Root cause: IP-filter bypass via IPv6-to-IPv4 ...

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

Summary Description An Improper Authorization CWE-285 issue in OpenAM's Liberty Web Services SOAP receiver allows an unauthenticated remote attacker to write persistent entries into the Liberty Discovery store on any user's LDAP entry, and into a shared root-realm Discovery branch. This impacts...

Astra Linux – vulnerability in sssd

A flaw was found in the System Security Services Daemon SSSD. The pampasskeychildreaddata function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Since the data is treated as a NUL-terminated C string without explicit termination, it leads to an...