Full List

Search

Recent Vulnerabilities

• CVE-2026-97851 • published on October 16, 2026 The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.
• CVE-2026-97849 • published on November 10, 2026 The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
• CVE-2026-97848 • published on November 6, 2026 A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.
• CVE-2026-97847 • published on November 5, 2026 A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.
• CVE-2026-97846 • published on September 25, 2026 Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.
• CVE-2026-97845 • published on November 12, 2026 An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).
• CVE-2026-97844 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97843 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97842 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97841 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97840 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97839 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97838 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97837 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97836 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97835 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97834 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97833 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97832 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97831 • published on October 13, 2026 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.