CVE-2026-19608

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in...

CVE-2026-19608

A flaw in the group policy provider of Keycloak authorization services allows unauthorized access to protected resources. The root cause is that group-based policy evaluation uses tokens containing only group names rather than full paths . When two groups in different parts of the organization hi...

CVE-2026-19608

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in...

Improper Authentication

Spring Cloud Config Server is vulnerable to Improper Authentication. The vulnerability is due to SessionManager persisting the first Vault token and ignoring subsequent X-CONFIG-TOKEN values, causing requests to use a previously stored token instead of the client-supplied token...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch4 Vulnerability Details CVEID:CVE-2026-48522 DESCRIPTION: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen whic...

CVE-2026-75090

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

CVE-2026-75090 EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

EUVD-2026-60564

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

ANT-2026-S8PHCV74 · cloudfoundry/uaa · auth_bypass

auth-bypass medium Severity Claude high · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-S8PHCV74: DenyAccessToUaaAdvice case-sensitive check bypassed on MySQL: zones.write overwrites syste...

ANT-2026-GEM3N3N3 · RocketChat/Rocket.Chat · NoSQL Injection

sql-injection critical CVE-2026-29198 Severity Claude critical · Security research firm - · Maintainer critical REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-GEM3N3N3: Critical vulnerability cvss 9.8: complete authentication bypass to admin permissions On Rocket.Chat...

SUSE CVE-2026-75010

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...

PT-2026-76916

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in...

PT-2026-77226

Name of the Vulnerable Software and Affected Versions Submariner operator affected versions not specified Description A flaw in the Submariner operator allows a long-lived broker service account SA bearer token to be exposed within the Submariner Custom Resource CR specification. An attacker with...

PT-2026-78230

Name of the Vulnerable Software and Affected Versions Tapo C200 version v5 Description An improper authentication issue exists within the login authentication verification module. An attacker on the local network can exploit weaknesses in the validation of the challenge parameter to bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-74323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996txprepareskb If linkconf or linksta...

CVE-2026-50143: Server-Side Request Forgery (SSRF)

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

CVE-2026-62684: Exposure of Sensitive Information to an Unauthorized Actor

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...

CVE-2026-23922: Insufficiently Protected Credentials

The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint...

PT-2026-80427

S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone...

PT-2026-80446

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...