Read the docs

Red Hat

Records7413All Threatist records
Exploited (KEV)98In CISA KEV
CVSS critical792CVSS 9.0–10.0
CVSS high2681CVSS 7.0–8.9

Exploited now

Red Hat records in CISA KEV
TI-2026-34021 Linux Kernel Missing Initialization of a Variable Vulnerability Priority CRITICAL 93KEV 2026-10-28TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2026-35991 Kludex Starlette HTTP Request/Response Smuggling Vulnerability Priority CRITICAL 86KEV 2026-09-02TI-2015-02874 Red Hat Libuser Race Condition Vulnerability Priority CRITICAL 92KEV 2026-08-26TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04

Components

Products in the NVD configurations · select one to filter the records
Enterprise Linux 1956 records CRITICAL Enterprise Linux Desktop 1928 records CRITICAL Enterprise Linux Server 1891 records CRITICAL Enterprise Linux Workstation 1845 records CRITICAL Enterprise Linux Server Aus 1061 records CRITICAL Enterprise Linux Eus 796 records CRITICAL Enterprise Linux Server Tus 770 records CRITICAL Enterprise Linux Server Eus 622 records CRITICAL

Records

98 records in Keycloak · all components

TI-2024-01049 CVE-2024-1132 · GHSA-72vp-xfrc-42xm

Keycloak: path transversal in redirection validation

Priority HIGH 70

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01552 Published 2024-04-17 Partial fix · 22.0.10, 24.0.3 +12 CWE-22
TI-2023-26623 CVE-2023-48795 · GHSA-45x7-px36-x8w8

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6…

Priority HIGH 70

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.93547 Published 2023-12-18 Partial fix · 0.40.2, 0.17.0 +2 CWE-354
TI-2020-08665 CVE-2020-10770 · GHSA-jh7q-5mwf-qvhw

Server-side request forgery in keycloak

Priority MEDIUM 61

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.69724 Published 2020-12-15 Fixed in 13.0.0 CWE-918
TI-2022-03468 CVE-2022-3782 · GHSA-g8q8-fggx-9r3q

Path traversal in Red Hat Keycloak

Priority MEDIUM 56

keycloak: path traversal via double URL encoding.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05953 Published 2023-01-11 Partial fix · 20.0.2 CWE-22
TI-2022-03994 CVE-2022-4361 · GHSA-3p62-6fjh-3p5h

Cross-site scripting in keycloak

Priority MEDIUM 50

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00691 Published 2023-07-07 Fixed in 21.1.2 CWE-81
TI-2020-16908 CVE-2020-27838 · GHSA-pcv5-m2wh-66j3

Improper authentication in keycloak

Priority MEDIUM 46

A flaw was found in keycloak in versions prior to 13.0.0.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.17866 Published 2021-03-08 Partial fix · 13.0.0 CWE-287
TI-2022-01132 CVE-2022-1245 · GHSA-75p6-52g3-rqc8

Missing authorization in keycloak

Priority MEDIUM 45

A privilege escalation flaw was found in the token exchange feature of keycloak.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01448 Published 2022-07-07 Fixed in 18.0.0 CWE-862
TI-2021-03493 CVE-2021-20195 · GHSA-q6w2-89hq-hq27

Improper input validation in keycloak

Priority MEDIUM 44

A flaw was found in keycloak in versions before 13.0.0.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01249 Published 2021-05-28 Fixed in 13.0.0 CWE-20
TI-2019-11112 CVE-2019-14910 · GHSA-jf86-9434-f8c2

Improper authentication in Keycloak

Priority MEDIUM 44

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if inv…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01054 Published 2019-12-05 No fix listed CWE-287
TI-2020-01659 CVE-2020-1714 · GHSA-m6mm-q862-j366

Improper input validation in Red Hat keycloak

Priority MEDIUM 43

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02604 Published 2020-05-13 Partial fix · 11.0.0 CWE-20
TI-2019-11042 CVE-2019-14837 · GHSA-cf8f-w2c5-p5jr

Hard-coded credentials in Red Hat keycloak

Priority MEDIUM 43

A flaw was found in keycloack before version 8.0.0.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01718 Published 2020-01-07 Fixed in 8.0.0 CWE-547
TI-2023-04529 CVE-2023-4918 · GHSA-5q66-v53q-pm35

Plaintext storage of user password

Priority MEDIUM 41

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00574 Published 2023-09-12 Fixed in 22.0.3 CWE-256
TI-2021-03009 CVE-2021-4133 · GHSA-83x4-9cwr-5487

Incorrect authorization in Keycloak

Priority MEDIUM 41

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user regist…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01373 Published 2022-01-25 Fixed in 15.1.1 CWE-863
TI-2023-06246 CVE-2023-6841 · GHSA-w97f-w3hq-36g2

Keycloak: amount of attributes per object is not limited and it may lead to dos

Priority MEDIUM 40

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send b…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00736 Published 2024-09-10 Partial fix · 24.0.0 CWE-231
TI-2020-01662 CVE-2020-1718 · GHSA-j229-2h63-rvh9

Improper authentication in Red Hat keycloak

Priority MEDIUM 40

A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01004 Published 2020-05-12 Partial fix · 8.0.0 CWE-287
TI-2023-06202 CVE-2023-6787 · GHSA-c9h6-v78w-52wj

Keycloak: session hijacking via re-authentication

Priority LOW 39

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00744 Published 2024-04-25 Partial fix · 22.0.10, 24.0.3 +3 CWE-287
TI-2019-07520 CVE-2019-10199 · GHSA-p5xp-6vpf-jwvh

Cross-site request forgery in Red Hat keycloak

Priority LOW 39

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00495 Published 2019-08-14 Partial fix · 7.0.0 CWE-352
TI-2016-07071 CVE-2016-8609 · GHSA-95m6-mjh3-58gm

Session fixation in Red Hat keycloak

Priority LOW 39

It was found that the keycloak before 2.3.0 did not implement authentication flow correctly.

CVSS 3.0HIGH 8.1 Network No auth User interaction EPSS 0.01679 Published 2018-08-01 Fixed in 2.3.0 CWE-384
TI-2022-03783 CVE-2022-4137 · GHSA-9hhc-pj4w-w5rv

Keycloak: reflected xss attack

Priority LOW 38

A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01193 Published 2023-09-25 Fixed in 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso +2 CWE-81
TI-2019-11111 CVE-2019-14909 · GHSA-fv4q-wm8c-wjg4

Improper authentication in Keycloak

Priority LOW 38

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.01076 Published 2019-12-04 No fix listed CWE-287
TI-2020-11257 CVE-2020-14389 · GHSA-c9x9-xv66-xp3v

Improper privilege management in keycloak

Priority LOW 37

It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to h…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00822 Published 2020-11-17 Fixed in 12.0.0 CWE-916
TI-2020-08655 CVE-2020-10758 · GHSA-52rg-hpwq-qp56

Resource allocation without limits in Keycloak

Priority LOW 37

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01947 Published 2020-09-16 Partial fix · 11.0.1 CWE-770
Load more
Open these records in search →