allegation
A critical vulnerability in Keycloak's reset-credentials (CVE-2026-18963, CVSS 9.1) allows any authenticated user, including administrators, to complete a password reset and set a new password.
A allegation by turansecurity. Statements are as reported by the cited publishers — not verified by DecisionGateway.
Keycloak'ning reset-credentialsdagi kritik zaiflik (CVE-2026-18963, CVSS 9.1) autentifikatsiyasi istalgan foydalanuvchi (shu jumladan administratorlar) uchun parol tiklashni yakunlash va yangi parol o'rnatish imkonini beradi.
Related claims
Red Hat Build of Keycloak users should apply RHSA-2026:56519 / 56520 / 56523 / 56524.turansecurity · commitmentThe risk level is Critical with CVSS v4.0 score 9.2, tracked as CVE-2026-109618 and CVE-2026-109619.Turan Security Xavfsizlik Byulleteni · statementAfter a user selects "是，且不再询问", command text containing secrets may be written into .claude/settings.local.json and then mistakenly committed to repositories.Apiiro · allegationA CVE-2026-111497 vulnerability was identified in Google's Brotli data compression library.Turan Security Xavfsizlik Byulleteni · investigationA vulnerability designated worse_query affects iOS 26.7.1·27.0.1·27.2 and allows a malicious app to read other apps' local files, potentially exposing seed phrases, private keys and login credentials.바이낸스 · allegationA critical Path Traversal / Arbitrary File Read vulnerability, CVE-2026-85706, was identified in GitLab CE/EE systems.Turan Security xavfsizlik byulleteni · investigation
More claims by turansecurity
Red Hat Build of Keycloak users should apply RHSA-2026:56519 / 56520 / 56523 / 56524.commitmentUpgrade to 26.7.2 / 26.6.6 / 26.4.15 (LTS); the fix is also available in 26.8.0.commitmentUnsupported branches (26.5, 26.3 and older) will not be fixed and remain permanently vulnerable until upgraded.predictionAll versions prior to 26.7.2, 26.6.6 and 26.4.15 (LTS) are affected.statementExploit code has not yet been distributed, but the CVE is confirmed.statement
All claims by turansecurity