The full-scope-disabled client-policy executor in Red Hat Build of Keycloak silently skips enforcement when the fullScopeAllowed attribute is absent from a client registration or update request, allowing a delegated user to create OAuth/OIDC clients with unrestricted scope access. Affected platforms span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and JBoss EAP Expansion Pack. An attacker holding delegated registration privileges (CVSS PR:L) can exploit this to issue tokens containing unauthorized role mappings, effectively escalating their effective permissions within any application trusting those tokens. No public exploit code or CISA KEV entry has been identified at time of analysis.
Stored cross-site scripting in luci-app-adblock-fast before 1.2.4-4 allows a lower-privileged LuCI user to inject malicious JavaScript into the blocklist name field, which executes in an administrator's browser under the LuCI origin when the AdBlock Fast status page is viewed. Because the payload runs within the LuCI same-origin context, a successful attack could enable session hijacking, unauthorized router reconfiguration, or privilege escalation from low-privileged user to effective admin control. No public exploit is identified at time of analysis; a vendor patch is available via the GitHub Security Advisory GHSA-q335-4c83-c88h.