GHSA-R7RC-C989-86G6 Keycloak: Attacker can re-enable and take over disabled clients via registration access token

Description A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token RAT, could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing...

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

Description A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token RAT, could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing...

CVE-2026-114727

A flaw was found in Roundcube Webmail. The application allows unsafe image types, specifically Scalable Vector Graphics SVG and Encapsulated PostScript EPS, to be uploaded for contact photos. An authenticated remote attacker can exploit this vulnerability by submitting a crafted image file that...

CVE-2026-63163

The Omnispace Agora Project before version 26.10.0 is vulnerable to a broken access control flaw in the MobileFileDownload route. The root cause is that the system relies on a predictable md5(filename) token for access rather than performing a proper authorization check. This allows unauthenticat...

EUVD-2026-100576

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5filename token instead of passing a proper authorization check. Attackers can guess or determi...

CVE-2026-63163 Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5filename token instead of passing a proper authorization check. Attackers can guess or determi...

CVE-2026-89204

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized...

CVE-2026-89204

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized...

EUVD-2026-98397

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal...

PT-2026-111401

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Improper access control exists regarding database queries used for subnet management. An authenticated attacker can exploit this to read, modify, or delete subnet configurations, resulting ...

CVE-2026-87744

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

CVE-2026-108730

A flaw was found in Raven. Legacy application programming interface API endpoints fail to verify workspace membership when retrieving messages and shared files. An authenticated remote attacker who is not a member of a workspace can exploit this flaw using predictable channel identifiers, resulti...

CVE-2026-106562

A flaw was found in Backstage search backend plugins. In deployments configured with permission enforcement and backed by an Elasticsearch or OpenSearch service, search engine filtering fails to properly apply document denial policies. An authenticated user can exploit this issue during search...

CVE-2026-106461

A flaw was found in plugin-scaffolder-backend. An improper authorization flaw allows an authenticated user to view task metadata outside their intended permissions, resulting in unauthorized information disclosure. This vulnerability occurs during scaffolder task listing when deployment permissio...

kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface VTI module. When a VTI tunnel device is moved to a different network environment, an unprivileged user in a separate user space can manipulate tunnel parameters. This manipulation could allow the user to intercept or redirect...

CVE-2026-107174: UNIX Symbolic Link (Symlink) Following

A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction...

CVE-2026-104047: Improper Neutralization of Delimiters

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause...

PT-2026-107173

Name of the Vulnerable Software and Affected Versions SSSD affected versions not specified Description When configured to use Microsoft Entra ID, SSSD fails to properly sanitize search inputs before incorporating them into directory query filters. A local user can exploit this by submitting a...

EUVD-2026-92711

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...

CVE-2026-73270

A flaw was found in Erlang/OTP inets httpd. This vulnerability allows a remote, unauthenticated attacker to bypass directory protection and read sensitive files. The issue occurs on systems with case-insensitive filesystems, where an attacker can request files using different letter casing to...