https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:47:14.599366+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-53424 EUVD-2026-53424 2026-10-03T11:47:14.604482+00:00 EUVD-2026-53424 https://cve.radiocsirt.org/vuln/fkie_cve-2019-10157 fkie_cve-2019-10157 2026-10-03T11:47:14.604518+00:00

It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.

 https://cve.radiocsirt.org/vuln/ghsa-68hw-vfh7-xvg8 GHSA-68hw-vfh7-xvg8 — Forced Logout in keycloak-connect 2026-10-03T11:47:14.604553+00:00

Affected: npm: keycloak-connect

Versions of `keycloak-connect` prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the `/k_logout` route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely.

## Recommendation

Upgrade to version 4.4.0 or later.

 https://cve.radiocsirt.org/vuln/gsd-2019-10157 gsd-2019-10157 2026-10-03T11:47:14.604579+00:00 gsd-2019-10157 https://cve.radiocsirt.org/vuln/rhsa-2019:1456 RHSA-2019:1456 — Red Hat Security Advisory: Red Hat Single Sign-On 7.3.2 security update 2026-10-03T11:47:14.604619+00:00

bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy bootstrap: XSS in the tooltip data-viewport attribute bootstrap: XSS in the affix configuration target property picketlink: reflected XSS in SAMLRequest via RelayState parameter picketlink: URL injection via xinclude parameter keycloak: missing signatures validation on CRL used to verify client certificates undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed bootstrap: XSS in the tooltip or popover data-template attribute keycloak: Node.js adapter internal NBF can be manipulated leading to DoS. jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1947 WID-SEC-W-2022-1947 — Red Hat Single Sign On: Mehrere Schwachstellen 2026-10-03T11:47:14.604663+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Single Sign On ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, einen Denial of Service Zustand hervorzurufen, Informationen auszuspähen, Sicherheitsvorkehrungen zu umgehen oder beliebigen Programmcode auszuführen.