https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:54:17.837799+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-12476 EUVD-2026-12476 2026-10-02T19:54:17.846606+00:00 EUVD-2026-12476 https://cve.radiocsirt.org/vuln/fkie_cve-2022-2668 fkie_cve-2022-2668 2026-10-02T19:54:17.846638+00:00

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

 https://cve.radiocsirt.org/vuln/ghsa-wf7g-7h6h-678v GHSA-wf7g-7h6h-678v — Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console 2026-10-02T19:54:17.846667+00:00

Affected: Maven: org.keycloak:keycloak-parent

An issue was discovered in Keycloak allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the `UPLOAD_SCRIPTS` feature is disabled

 https://cve.radiocsirt.org/vuln/gsd-2022-2668 gsd-2022-2668 2026-10-02T19:54:17.846690+00:00 gsd-2022-2668 https://cve.radiocsirt.org/vuln/rhsa-2022:6782 RHSA-2022:6782 — Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 7 2026-10-02T19:54:17.846702+00:00

jackson-databind: denial of service via a large depth of nested objects h2: Remote Code Execution in Console netty: control chars in header names may lead to HTTP request smuggling xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr keycloak: Stored XSS in groups dropdown wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled keycloak: improper input validation permits script injection keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console