Security Operations
Threat Intelligence
🔎
❓

Vulnerability Intelligence

Correlated vulnerability reporting from CISA, NVD/NIST, NCSCs, MSRC and vendor advisories. Search a vendor or product - e.g. "Microsoft Exchange".
DEMO MODE
CVETitleSeverityCVSSVendor / ProductExploitationSources
CVE-2026-9086 GHSA-v3f7-2p4r-mwfw - Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass HIGH 7.3 org.keycloak:keycloak-services org.keycloak:keycloak-services Unknown 1 Details
CVE-2026-9083 GHSA-9jrw-8xf7-xqhq - Keycloak vulnerable to information disclosure through arbitrary filesystem path probing MEDIUM 4.9 org.keycloak:keycloak-services org.keycloak:keycloak-services Unknown 1 Details
CVE-2026-9799 GHSA-w3p3-7cjg-vgfw - Keycloak allows unauthorized access to resources via uma permission ticket bypass MEDIUM 4.6 org.keycloak:keycloak-services org.keycloak:keycloak-services Unknown 1 Details
CVE-2026-9800 GHSA-f5p5-6xmx-p252 - Keycloak vulnerable to authorization bypass via incorrect uri comparison HIGH 8.1 org.keycloak:keycloak-servicesorg.keycloak:keycloak-policy-enforcer org.keycloak:keycloak-servicesorg.keycloak:keycloak-policy-enforcer Unknown 1 Details
CVE-2026-9705 GHSA-r7rc-c989-86g6 - Keycloak: Attacker can re-enable and take over disabled clients via registration access token MEDIUM 6.5 org.keycloak:keycloak-services org.keycloak:keycloak-services Unknown 1 Details
- GHSA-w9x9-j56r-h98r - @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy HIGH 8.2 @eeacms @eeacms/volto-chatbot Unknown 1 Details
CVE-2026-61848 GHSA-8vfg-2r28-hvhj - Crass: Non-ASCII characters cause superlinear CPU consumption MEDIUM - crassRed Hat crass Unknown 3 sources Details
CVE-2026-61847 GHSA-wwpr-jff3-395c - Crass: A large number of adjacent CSS comments can trigger a SystemStackError HIGH - crassRed Hat crass Unknown 3 sources Details
CVE-2026-61846 GHSA-6jxj-px6v-747w - Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage MEDIUM - crassRed Hat crass Unknown 3 sources Details
- GHSA-c33x-vcv4-vg3g - Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence LOW - cedar-policy@cedar-policy cedar-policy@cedar-policy/cedar-wasm Unknown 1 Details
CVE-2026-62264 GHSA-q344-5v34-gm84 - @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY HIGH 7.5 @sylphx @sylphx/pdf-reader-mcp Unknown 2 sources Details
CVE-2026-61438 GHSA-26mh-57q7-jfvr - PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox HIGH 7.3 praisonai praisonai Unknown 1 Details
CVE-2026-61448 GHSA-r899-h629-j84r - Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist LOW - parse-server parse-server Unknown 1 Details
CVE-2026-62160 GHSA-rhj7-vh3v-mcq6 - Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware HIGH - github github.com/daptin/daptin Unknown 2 sources Details
- GHSA-pg53-p7qp-65cv - PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets LOW - pocketmine pocketmine/pocketmine-mp Unknown 1 Details
CVE-2026-55186 GHSA-68wq-phq7-p2vg - MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow MEDIUM 4.2 silverstripe silverstripe/mfa Unknown 1 Details
CVE-2026-96203 CVE-2026-96203 - Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. HIGH 8.8 microsoft Unknown 1 Details
CVE-2026-96192 CVE-2026-96192 - Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network. HIGH 8.8 microsoft Unknown 1 Details
CVE-2026-96187 CVE-2026-96187 - Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized HIGH 7.4 microsoft Unknown 1 Details
CVE-2026-93680 CVE-2026-93680 - IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper auth CRITICAL 9.8 Unknown 1 Details