CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2026-107889 Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

EUVD-2026-95478

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2026-107889

A stored Cross-Site Scripting (XSS) vulnerability exists in the login theme rendering component of Keycloak . The flaw arises because the security filter intended to sanitize user input can be bypassed, enabling a realm administrator to inject malicious scripts into display fields. If exploited, ...

CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

PT-2026-109160

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

CVE-2026-94064: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...

CVE-2026-107889: Improper Neutralization of Input During Web Page Generation

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

PT-2026-108914

Name of the Vulnerable Software and Affected Versions Neo | Barber Shop WordPress Theme versions prior to 3.6 Description An issue in the neocut component allows Object Injection due to the deserialization of untrusted data. Object Injection occurs when an application deserializes untrusted data,...

WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Backhoe versions = 2.0...

WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Ozeum versions = 1.3.0...

WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flipmart versions = 2.8...

WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Fabius versions = 1.0...

WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Equadio versions = 1.1.4...

WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Juno versions = 2.25...

WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme N7 | Golf Club Sports & Events versions = 2.21...

WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Invetex versions = 2.18...

WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Asia Garden versions = 1.3.1...

WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin ThemeStek Extras for LabtechCO Theme versions = 8.4...