https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:43:33.214130+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-12244 EUVD-2026-12244 2026-10-03T11:43:33.312179+00:00 EUVD-2026-12244 https://cve.radiocsirt.org/vuln/fkie_cve-2022-2256 fkie_cve-2022-2256 2026-10-03T11:43:33.312215+00:00

A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.

 https://cve.radiocsirt.org/vuln/ghsa-w9mf-83w3-fv49 GHSA-w9mf-83w3-fv49 — Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles 2026-10-03T11:43:33.312247+00:00

Affected: Maven: org.keycloak:keycloak-parent

A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release (18.0.1). The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the default roles functionality.

### CVSS 3.1 - **3.8**

**Vector String:** AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

**Vector Clarification:**

* User interaction is not required as the admin console is regularly used during an administrator's work * The scope is unchanged since the admin console web application is both the vulnerable component and where the exploit executes

### Credits

Aytaç Kalıncı, Ilker Bulgurcu, Yasin Yılmaz (@aytackalinci, @smileronin, @yasinyilmaz) - NETAŞ PENTEST TEAM

 https://cve.radiocsirt.org/vuln/gsd-2022-2256 gsd-2022-2256 2026-10-03T11:43:33.312285+00:00 gsd-2022-2256 https://cve.radiocsirt.org/vuln/rhsa-2022:6782 RHSA-2022:6782 — Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 7 2026-10-03T11:43:33.312298+00:00

jackson-databind: denial of service via a large depth of nested objects h2: Remote Code Execution in Console netty: control chars in header names may lead to HTTP request smuggling xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr keycloak: Stored XSS in groups dropdown wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled keycloak: improper input validation permits script injection keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0794 WID-SEC-W-2024-0794 — Dell ECS: Mehrere Schwachstellen 2026-10-03T11:43:33.312324+00:00

Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.