https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:20:04.095073+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-01978 bdu:2023-01978 2026-10-03T04:20:04.183955+00:00 bdu:2023-01978 https://cve.radiocsirt.org/vuln/euvd-2026-12696 EUVD-2026-12696 2026-10-03T04:20:04.184006+00:00 EUVD-2026-12696 https://cve.radiocsirt.org/vuln/fkie_cve-2022-4137 fkie_cve-2022-4137 2026-10-03T04:20:04.184020+00:00

A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.

 https://cve.radiocsirt.org/vuln/ghsa-9hhc-pj4w-w5rv GHSA-9hhc-pj4w-w5rv — Keycloak Cross-site Scripting on OpenID connect login service 2026-10-03T04:20:04.184050+00:00

Affected: Maven: org.keycloak:keycloak-parent

A reflected cross-site scripting (XSS) vulnerability was found in the `oob` OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page.

 https://cve.radiocsirt.org/vuln/gsd-2022-4137 gsd-2022-4137 2026-10-03T04:20:04.184073+00:00 gsd-2022-4137 https://cve.radiocsirt.org/vuln/rhsa-2023:1043 RHSA-2023:1043 — Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7 2026-10-03T04:20:04.184085+00:00

bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods glob-parent: Regular Expression Denial of Service minimist: prototype pollution keycloak: HTML injection in execute-actions-email Admin REST API keycloak: XSS on impersonation under specific circumstances SnakeYaml: Constructor Deserialization Remote Code Execution Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations keycloak: Session takeover with OIDC offline refreshtokens keycloak: reflected XSS attack Moment.js: Path traversal in moment.locale snakeyaml: Denial of Service due to missing nested depth limitation for collections moment: inefficient parsing algorithm resulting in DoS loader-utils: Regular expression denial of service snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match jettison: parser crash by stackoverflow jettison: memory exhaustion via user-supplied XML or J…