CVE-2026-33584

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics and health data. This issue affects Symmetric Key Agreement Platform: before 26.03.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-749

Affected software

VendorProductVersions
ArqitSymmetric Key Agreement Platform< 26.03

References

Timeline

Published
May 13, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-335853.8Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an CVE-2026-335866.3Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail serCVE-2026-3358710.0Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) onCVE-2026-335888.1Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify filesCVE-2026-335896.5Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files conCVE-2026-33597.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inpuCVE-2026-335908.5Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code eCVE-2026-3359110.0A vulnerability in Wapt Server before version 2.6.1.17813 allows a  remote unauthenticated attacker to bypass security restriction using a sCVE-2026-335927.5An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FinCVE-2026-335937.5A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.CVE-2026-335947.5A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing querieCVE-2026-335957.5A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some reso