https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:04:30.437405+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-67215 EUVD-2026-67215 2026-10-03T03:04:30.442303+00:00 EUVD-2026-67215 https://cve.radiocsirt.org/vuln/fkie_cve-2018-14655 fkie_cve-2018-14655 2026-10-03T03:04:30.442335+00:00

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

 https://cve.radiocsirt.org/vuln/ghsa-458h-wv48-fq75 GHSA-458h-wv48-fq75 — Keycloak vulnerable to cross-site scripting via the state parameter 2026-10-03T03:04:30.442365+00:00

Affected: Maven: org.keycloak:keycloak-parent

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using `response_mode=form_post` it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

 https://cve.radiocsirt.org/vuln/gsd-2018-14655 gsd-2018-14655 2026-10-03T03:04:30.442391+00:00 gsd-2018-14655 https://cve.radiocsirt.org/vuln/rhsa-2018:3592 RHSA-2018:3592 — Red Hat Security Advisory: Red Hat Single Sign-On 7.2.5 on RHEL 6 security and bug fix update 2026-10-03T03:04:30.442403+00:00

keycloak: auth permitted with expired certs in SAML client keycloak: expiration not validated in SAML broker consumer endpoint keycloak: XSS-Vulnerability with response_mode=form_post keycloak: brute force protection not working for the entire login workflow keycloak: Open Redirect in Login and Logout