https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T13:34:47.189807+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-17783 cnvd-2021-17783 2026-10-03T13:34:47.250320+00:00 cnvd-2021-17783 https://cve.radiocsirt.org/vuln/euvd-2026-35552 EUVD-2026-35552 2026-10-03T13:34:47.250358+00:00 EUVD-2026-35552 https://cve.radiocsirt.org/vuln/fkie_cve-2020-1694 fkie_cve-2020-1694 2026-10-03T13:34:47.250373+00:00

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.

 https://cve.radiocsirt.org/vuln/ghsa-72j4-94rx-cr6w GHSA-72j4-94rx-cr6w — Incorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak 2026-10-03T13:34:47.250405+00:00

Affected: Maven: org.keycloak:keycloak-parent

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.

 https://cve.radiocsirt.org/vuln/gsd-2020-1694 gsd-2020-1694 2026-10-03T13:34:47.250430+00:00 gsd-2020-1694 https://cve.radiocsirt.org/vuln/rhsa-2020:2813 RHSA-2020:2813 — Red Hat Security Advisory: Red Hat Single Sign-On 7.4.1 security update 2026-10-03T13:34:47.250443+00:00

keycloak: verify-token-audience support is missing in the NodeJS adapter keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution jackson-databind: Lacks certain xbean-reflect/JNDI blocking jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core undertow: invalid HTTP request with large chunk size keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697) jackson-databind: Serialization gadgets in javax.swing.JEditorPane jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods