CVE-2026-7646

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

keycloak-services: keycloak-services: Default DCR policy allows role forgery via User Property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

keycloak: Keycloak: Brute-force protection bypass in CIBA flow

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication CIBA flow to bypass this...

keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions FGAP v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not...

keycloak: Keycloak: Brute-force protection bypass in CIBA flow

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication CIBA flow to bypass this...

keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions FGAP v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not...

CVE-2026-39923

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

MAL-2026-13352 Malicious code in stellar-api-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd4c86bebaa61a9aada2c1686d68eb5119025ea4646426ea7da3db4ce4208707 The package's constructor unconditionally appends a hardcoded Discord user ID 1489655840662093854 to the caller-supplied adminIds list, granting that...

MAL-2026-13349 Malicious code in mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8871a9cd738ee7dbe2245e741d52afb659069bc6fcc7d5aa6cfb87bfad9dbcd On require, index.js serializes the full process.env along with hostname, username, homedir, platform, and cwd, base64-encodes the JSON blob, and...

MAL-2026-13214 Malicious code in @zzzcrypto/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ceac45508e2f9506a082b2195d3bae4b046f096d11856d72ea53f784ad5992e @zzzcrypto/[email protected] is a typosquat/impersonation of @solana/spl-token README self-describes as a 'drop-in replacement'; author metadata...

CVE-2026-16102

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

EUVD-2026-53392

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...

CVE-2026-39924 Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...

CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

EUVD-2026-53389

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug

HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The three most serious: An unauthenticated flaw in Veeam's console that hands over a managed agent's credentials, rated 9.5 A cross-tenant...

CVE-2026-16102

Keycloak-DCR: The default Dynamic Client Registration policy allows forging roles via User Property mappers due to insufficient claim-path validation. This enables a standard-user with a limited Initial Access Token to write to sensitive internal claim locations, forging administrative roles in t...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-71277

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. Authorizatio...