Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the getRoleUserMembers path in RoleContainerResource...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +205 more potentially affected by CVE-2026-17059 via org.keycloak:keycloak-services (>=12.0.0, <=26.7.2)

org.keycloak:keycloak-services MAVEN version =12.0.0, =0.1.0, =3.1.13-jdk1.8, =12.0.0, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-17059 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752090...

Authentication Bypass

LiteLLM is vulnerable to Authentication Bypass. The vulnerability is due to improper handling of the MCP authentication fallback path, where failed LiteLLM key validation is replaced with an empty authentication object, which allows an unauthenticated attacker to exploit the MCP Streamable HTTP...

OESA-2026-3151 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

OESA-2026-3147 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

OESA-2026-3150 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

OESA-2026-3149 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

CVE-2026-15704 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...

PT-2026-64299

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the role-users endpoint of the keycloak-services library. The system fails to verify if an administrator has the necessary permissions to view individual users when listing...

CVE-2026-8308: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS. This issue affects Website Template: before v2...

CVE-2026-17059: Authorization Bypass Through User-Controlled Key

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

CVE-2026-16584 AWS API MCP Server Security Policy Bypass via Startup Failure

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data...

Azure Portal Information Disclosure Vulnerability

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

Astra Linux – Vulnerability in Chromium

Using free services in Chromoting in Google Chrome before version 147.0.7727.138 allowed a remote attacker to execute arbitrary code through malicious network traffic. Chromium security severity: High...

CVE-2026-64873

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

RHSA-2026:42122 Red Hat Security Advisory: sssd security update

Bulletin has no description...

CVE-2026-64873

The Cache Cleaner Pro extension for Joomla (by regularlabs.com) is vulnerable to Server-Side Request Forgery (SSRF) . This vulnerability allows an attacker to use custom query URLs to access internal or reserved network services. Exploitation details are not provided in the documents. No remediat...

CVE-2026-64873

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...