Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-70597 — Electron: Parent process code-sign check is spoofable

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm…

| Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-54876 — Client-Side Memory Leak in OCSP Response Checking

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact sum…

| Denial of Service
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-17613 — CVE-2026-17613

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket eve…

| Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.1 HIGH
CVE-2026-16102 — Keycloak-services: keycloak-services: default dcr policy allows role forgery via user pro…

A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User …

single_sign-on data_grid build_of_keycloak | Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-16100 — Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics …

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because t…

single_sign-on data_grid build_of_keycloak | Remote | Information Disclosure
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.4 MEDIUM
CVE-2026-16071 — Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users…

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using…

single_sign-on data_grid build_of_keycloak | Remote | Information Disclosure
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.1 HIGH
CVE-2026-15573 — Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching …

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By a…

single_sign-on data_grid build_of_keycloak | Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.8 HIGH
CVE-2026-12410 — CCleaner local privilege escalation via link following on uninstall

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction cre…

| Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-60053 — Apache Answer: Residual Administrative API Key Access After Role or Account Revocation

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted o…

answer | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-60023 — Apache Answer: Unauthorized disclosure of deleted or pending answer content

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by unauthor…

answer | Information Disclosure
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-50749 — Apache Answer: Missing authorization in revision audit reject allows authenticated users …

Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission …

answer | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-48912 — Apache Answer: Improper authorization in avatar update cleanup allows authenticated users…

Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to de…

answer | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-15572 — Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows …

A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, …

build_of_keycloak | Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-48911 — Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Con…

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flo…

answer | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-48834 — Apache Answer: Denial of service via crafted Accept-Language header parsing

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a sp…

answer | Denial of Service
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.4 HIGH
CVE-2026-16442 — Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only …

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fail…

single_sign-on data_grid build_of_keycloak | Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.1 MEDIUM
CVE-2026-53992 — Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Paramete…

ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized va…

Remote | Cross-Site Scripting
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-49331 — Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection o…

A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication (skip-auth-regex), the proxy forwards client-supplied identity headers (X-Forwarded-User, X-Forwarded-Email, X-…

openshift_container_platform | Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.6 HIGH
CVE-2026-39924 — Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, …

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70596 — Ghost: Cross-Site Scripting in Feature Image Captions

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hi…

| Information Disclosure
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
Showing 20 of 9750 Results