Security advisories

low2026-05-19

CVE-2026-7860-Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability

vaadin/flow · GHSA-j8mx-j73w-9mxw

high2026-05-19

CVE-2026-7571-Keycloak: Access token disclosure and implicit flow bypass via forged client data

keycloak/keycloak · GHSA-hq3p-w4xv-x7vp

high2026-05-19

CVE-2026-7507-Keycloak: Session fixation in OIDC login flow that can lead to account takeover

keycloak/keycloak · GHSA-hf67-5vvq-fm3r

high2026-05-19

CVE-2026-7307-Keycloak: Denial of Service via specially crafted SAML input

keycloak/keycloak · GHSA-p5mv-gj8j-xqgf

medium2026-05-19

CVE-2026-4630-Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers

keycloak/keycloak · GHSA-c739-f6xw-6pv2

medium2026-05-19

CVE-2026-37982-Keycloak: Unauthorized account takeover via WebAuthn token replay

keycloak/keycloak · GHSA-w4p5-rfh6-cwrv

medium2026-05-19

CVE-2026-37981-Keycloak Account Resources user lookup contains broken access control

keycloak/keycloak · GHSA-933f-rg6j-f46p

medium2026-05-19

CVE-2026-46721-TYPO3 sf_register extension allows unauthorized assignment of frontend user groups

evoweb/sf_register · GHSA-v348-vr4q-fv9p

medium2026-05-19

CVE-2026-37978-Keycloak: Information Disclosure via evaluate-scopes Admin API

keycloak/keycloak · GHSA-rrv7-3mqf-hxfr

high2026-05-19

CVE-2026-8727-TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)

tomasnorre/crawler · GHSA-jr8m-x4p7-p3v5

high2026-05-19

CVE-2026-8726-georgringer/news has SQL Injection in extension "News system" (news)

georgringer/news · GHSA-g868-j3qm-4j28

medium2026-05-19

CVE-2026-46722-TYPO3 ke_search XML External Entity Injection

tpwd/ke_search · GHSA-fq39-62gx-8hqx

medium2026-05-19

CVE-2026-46724-TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer

tpwd/ke_search · GHSA-c72x-mc2p-wv7x

medium2026-05-19

CVE-2026-46723-TYPO3 ke_search path traversal from arbitrary table configuration input

tpwd/ke_search · GHSA-67j3-jmm3-32xc

medium2026-05-19

CVE-2026-37979-Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass

keycloak/keycloak · GHSA-4x37-hw65-52w8

high2026-05-19

CVE-2026-8827-TYPO3 SQL Injection in extension "Address List" (tt_address)

friendsoftypo3/tt_address · GHSA-3h52-6v6j-6wwv

critical2026-05-19

CVE-2026-2611-MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

mlflow/mlflow · GHSA-67c5-x5mf-rppq

medium2026-05-19

CVE-2026-8922-Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured

keycloak/keycloak · GHSA-83c4-ffjp-mxp9

medium2026-05-19

CVE-2026-8830-Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation

keycloak/keycloak · GHSA-g8vr-x4qh-25qg

high2026-05-18

CVE-2026-4137-MLFlow Creates a Temporary File With Insecure Permissions

mlflow/mlflow · GHSA-f2m9-wcf4-cwwx