Red Hat

Records7414All Threatist records

Exploited (KEV)98In CISA KEV

CVSS critical793CVSS 9.0–10.0

CVSS high2681CVSS 7.0–8.9

Exploited now

Red Hat records in CISA KEV

TI-2026-34021 Linux Kernel Missing Initialization of a Variable Vulnerability CRITICAL 93KEV 2026-10-28 TI-2015-04610 ISC BIND Data Processing Errors Vulnerability CRITICAL 92KEV 2026-10-08 TI-2026-35991 Kludex Starlette HTTP Request/Response Smuggling Vulnerability CRITICAL 86KEV 2026-09-02 TI-2015-02874 Red Hat Libuser Race Condition Vulnerability CRITICAL 92KEV 2026-08-26 TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CRITICAL 93KEV 2026-08-26 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04

Components

Products in the NVD configurations · select one to filter the records

Enterprise Linux 1956 records CRITICAL Enterprise Linux Desktop 1928 records CRITICAL Enterprise Linux Server 1891 records CRITICAL Enterprise Linux Workstation 1845 records CRITICAL Enterprise Linux Server Aus 1061 records CRITICAL Enterprise Linux Eus 796 records CRITICAL Enterprise Linux Server Tus 770 records CRITICAL Enterprise Linux Server Eus 622 records CRITICAL

Records

111 records in Build Of Keycloak · all components

TI-2026-02223 CVE-2026-2603 · GHSA-x4p7-7chp-64hq

Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

HIGH 70

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00451 Published 2026-03-18 Fixed in 26.2.14-1, 26.2-16 +3 CWE-306

TI-2024-01049 CVE-2024-1132 · GHSA-72vp-xfrc-42xm

Keycloak: path transversal in redirection validation

HIGH 70

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01552 Published 2024-04-17 Partial fix · 22.0.10, 24.0.3 +12 CWE-22

TI-2026-13740 CVE-2026-16442 · GHSA-vj6m-hv26-qx79

Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

MEDIUM 42

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-08-05 Fixed in 26.4.14-1, 26.4-22 +2 CWE-346

TI-2026-13741 CVE-2026-16443 · GHSA-v5j7-jp89-37vr

Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation

MEDIUM 41

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00321 Published 2026-08-05 Fixed in 26.4.14-1, 26.4-22 +2 CWE-347

TI-2026-13106 CVE-2026-15572 · GHSA-cj2r-7gqh-wx4f

Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

MEDIUM 41

A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00652 Published 2026-08-05 Fixed in 26.4.14-1, 26.4-22 +2 CWE-843

TI-2026-02631 CVE-2026-3047 · GHSA-8cr3-vpxx-92cx

Authentication bypass in Red Hat build of Keycloak 26.2

MEDIUM 41

A flaw was found in org.keycloak.broker.saml.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00545 Published 2026-03-05 Fixed in 26.2.14-1, 26.2-16 +2 CWE-305

TI-2026-08505 CVE-2026-9704 · GHSA-rr5q-3xwr-f323

Keycloak: keycloak: privilege escalation due to oversized subject_token jwt

MEDIUM 40

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0032 Published 2026-05-27 Fixed in 26.4.13-1, 26.4-19 +3 CWE-1284

TI-2026-06414 CVE-2026-7307 · GHSA-p5mv-gj8j-xqgf

Keycloak: keycloak: denial of service via specially crafted saml input

MEDIUM 40

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00878 Published 2026-05-19 Fixed in 26.2.16, 26.4.12 +9 CWE-1286

TI-2026-04036 CVE-2026-4634 · GHSA-h4wv-g838-66g3

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

MEDIUM 40

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00638 Published 2026-04-02 Fixed in 26.2.15-1, 26.2-18 +7 CWE-1050

TI-2023-06202 CVE-2023-6787 · GHSA-c9h6-v78w-52wj

Keycloak: session hijacking via re-authentication

LOW 39

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00744 Published 2024-04-25 Partial fix · 22.0.10, 24.0.3 +3 CWE-287

TI-2026-13480 CVE-2026-16102 · GHSA-6x4h-v8cp-whwh

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

LOW 38

A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00459 Published 2026-08-05 Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551

TI-2026-13107 CVE-2026-15573 · GHSA-6j7g-hr6v-3hxc

Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

LOW 38

A flaw was found in Keycloak's Authorization Services.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00459 Published 2026-08-05 Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551

TI-2026-08588 CVE-2026-9800 · GHSA-79qw-g39g-mfxc · GHSA-f5p5-6xmx-p252

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

LOW 38

A flaw was found in Keycloak Policy Enforcer.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00651 Published 2026-06-25 Partial fix · 26.4.13-1, 26.4-19 +7 CWE-1025

TI-2026-06594 CVE-2026-7504 · GHSA-rp95-xpg9-c2cq

Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak

LOW 38

A flaw was found in Keycloak's URL validation logic during redirect operations.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00637 Published 2026-05-19 Fixed in 26.2.16-1, 26.2-21 +3 CWE-601

TI-2026-04038 CVE-2026-4636 · GHSA-f2hx-5fx3-hmcv

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

LOW 38

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00436 Published 2026-04-02 Fixed in 26.2.15-1, 26.2-18 +3 CWE-551

TI-2026-01295 CVE-2026-1609 · GHSA-5xcf-8m2w-ph6f

Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

LOW 38

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00562 Published 2026-07-16 Fixed in 26.5.3 CWE-284

TI-2024-07308 CVE-2024-7885 · GHSA-9623-mqmm-5rcf

Undertow: improper state management in proxy protocol parsing causes information leakage

LOW 38

A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02644 Published 2024-08-21 Partial fix · 2.2.36.Final, 2.3.17.Final +27 CWE-362

TI-2026-15502 CVE-2026-18967 · GHSA-fghp-hcwh-75j2

Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow

LOW 37

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution.

CVSS 3.1HIGH 8.1 Adjacent network No auth No interaction EPSS 0.00233 Published 2026-08-06 No fix listed CWE-294

TI-2026-14985 CVE-2026-18215 · GHSA-v8h5-7wp9-qxxv

Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant

LOW 37

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant).

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00404 Published 2026-07-31 Fixed in 26.6.7-3, 26.6-20 CWE-287

TI-2026-14984 CVE-2026-18214 · GHSA-wmhp-w67v-6jm5

Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction

LOW 37

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00402 Published 2026-07-31 Fixed in 26.6.7-3, 26.6-20 CWE-862

TI-2026-10185 CVE-2026-11800 · GHSA-gqj5-2xp5-3qmp · GHSA-j97h-3f8r-mrjr

Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion

LOW 37

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.003 Published 2026-06-25 Partial fix · 26.6.4-2, 26.6-8 +1 CWE-347

TI-2026-07984 CVE-2026-9087 · GHSA-m6qj-3mpp-57v8

Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

LOW 37

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00312 Published 2026-05-20 Fixed in 26.4.13-1, 26.4-19 +3 CWE-639

TI-2026-02598 CVE-2026-3009 · GHSA-m297-3jv9-m927

Incorrect authorization in Red Hat build of Keycloak 26.4

LOW 37

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0038 Published 2026-03-05 Partial fix · 26.4.10-1, 26.4-12 +1 CWE-863

TI-2026-07996 CVE-2026-9099 · GHSA-rmcj-82cr-27rx

Keycloak: group-admin escalation to realm-admin

LOW 36

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.7 Network High privileges No interaction EPSS 0.0049 Published 2026-06-25 Fixed in 26.4.13-1, 26.4-19 +2 CWE-639

TI-2026-06597 CVE-2026-7507 · GHSA-hf67-5vvq-fm3r

Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

LOW 36

A session fixation vulnerability was found in Keycloak's login-actions endpoints.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00836 Published 2026-05-19 Fixed in 26.2.16-1, 26.2-21 +7 CWE-290

Open these records in search →

Critical	793
High	2681
Medium	3429
Low	509
No CVSS	2