https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:11:23.418148+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-04661 cnvd-2020-04661 2026-10-03T06:11:23.527480+00:00 cnvd-2020-04661 https://cve.radiocsirt.org/vuln/euvd-2026-35568 EUVD-2026-35568 2026-10-03T06:11:23.527518+00:00 EUVD-2026-35568 https://cve.radiocsirt.org/vuln/fkie_cve-2020-1697 fkie_cve-2020-1697 2026-10-03T06:11:23.527532+00:00

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

 https://cve.radiocsirt.org/vuln/ghsa-8vf3-4w62-m3pq GHSA-8vf3-4w62-m3pq — XSS in Keycloak 2026-10-03T06:11:23.527564+00:00

Affected: Maven: org.keycloak:keycloak-core

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

 https://cve.radiocsirt.org/vuln/gsd-2020-1697 gsd-2020-1697 2026-10-03T06:11:23.527588+00:00 gsd-2020-1697 https://cve.radiocsirt.org/vuln/rhsa-2020:0445 RHSA-2020:0445 — Red Hat Security Advisory: Red Hat Single Sign-On 7.3.6 security update 2026-10-03T06:11:23.527600+00:00

xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285) hibernate-validator: safeHTML validator allows XSS jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS jackson-databind: Serialization gadgets in classes of the commons-configuration package jackson-databind: Serialization gadgets in classes of the xalan package jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource jackson-databind: Serialization gadgets in classes of the ehcache package jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* keycloak: stored XSS in client settings via application links