CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

EUVD-2026-75289

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

Malicious code in pylever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6720ca3891de59548dfdfc9b6af778b5bf97fb31c5188381c73e92c4ac2820e1 The package's Client class scans Chrome, Edge, and Brave browser profile LevelDB and Cache directories and the Discord Desktop app's Roaming/discord...

PT-2026-89456

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access...

PT-2026-89349

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2026-88865: Authorization Bypass Through User-Controlled Key

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

PT-2026-89383

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage tha...

PT-2026-102360

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The is pem format function in jwt/utils.py fails to recognize all PEM representations accepted by the cryptography loader. This occurs when an application uses both HMAC and asymmetric algorithms and...

PT-2026-102363

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.4.0 through 2.13.x Description The HMACAlgorithm.prepare key function is affected because the asymmetric-key guard relies on textual markers that are absent from DER Distinguished Encoding Rules encoding. This occurs when an...

PT-2026-89376

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit c3edcc274c389816d434acadac07ee78eaf330c1 Description Authenticated users with canStream permission can mint tokens for arbitrary restreams because the software fails to validate restream ownership in the...

PT-2026-89717

The opam package "jose" does not validate any RSA signature. It checks the encoding being PKCS1, but does not verify with the public key. Reproduction With jose 0.10.0, the code below signs two tokens with the same key and glues one's payload onto the other's signature: OCaml let = Mirage crypto...

PT-2026-89350

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

VulnCheck KEV: CVE-2026-42016

JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

VulnCheck KEV: CVE-2026-42018

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources...

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PT-2026-89454

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.0 through 0.11.0 Description The OAuth token exchange endpoint in backend/open webui/routers/auths.py issues a session for a provider access token without executing the OAuth role management checks performed by the...

CVE-2026-88006: Incorrect Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

PT-2026-89453

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.0 through 0.8.9 Description The OAuth token exchange endpoint in backend/open webui/routers/auths.py fails to apply the email domain allowlist that is normally enforced during the OAuth login callback. This occurs becau...

CVE-2026-88005: Incorrect Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...