https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:21:19.181198+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2019-44531 cnvd-2019-44531 2026-10-03T04:21:19.265742+00:00 cnvd-2019-44531 https://cve.radiocsirt.org/vuln/euvd-2026-49759 EUVD-2026-49759 2026-10-03T04:21:19.265777+00:00 EUVD-2026-49759 https://cve.radiocsirt.org/vuln/fkie_cve-2019-3875 fkie_cve-2019-3875 2026-10-03T04:21:19.265791+00:00

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.

 https://cve.radiocsirt.org/vuln/ghsa-38cg-gg9j-q9j9 GHSA-38cg-gg9j-q9j9 — Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak 2026-10-03T04:21:19.265823+00:00

Affected: Maven: org.keycloak:keycloak-core

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.

 https://cve.radiocsirt.org/vuln/gsd-2019-3875 gsd-2019-3875 2026-10-03T04:21:19.265850+00:00 gsd-2019-3875 https://cve.radiocsirt.org/vuln/rhsa-2019:1456 RHSA-2019:1456 — Red Hat Security Advisory: Red Hat Single Sign-On 7.3.2 security update 2026-10-03T04:21:19.265862+00:00

bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy bootstrap: XSS in the tooltip data-viewport attribute bootstrap: XSS in the affix configuration target property picketlink: reflected XSS in SAMLRequest via RelayState parameter picketlink: URL injection via xinclude parameter keycloak: missing signatures validation on CRL used to verify client certificates undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed bootstrap: XSS in the tooltip or popover data-template attribute keycloak: Node.js adapter internal NBF can be manipulated leading to DoS. jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1947 WID-SEC-W-2022-1947 — Red Hat Single Sign On: Mehrere Schwachstellen 2026-10-03T04:21:19.265891+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Single Sign On ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, einen Denial of Service Zustand hervorzurufen, Informationen auszuspähen, Sicherheitsvorkehrungen zu umgehen oder beliebigen Programmcode auszuführen.