https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:39:14.475083+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-227951 EUVD-2026-227951 2026-10-03T01:39:14.550969+00:00 EUVD-2026-227951 https://cve.radiocsirt.org/vuln/fkie_cve-2023-0091 fkie_cve-2023-0091 2026-10-03T01:39:14.551006+00:00

A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.

 https://cve.radiocsirt.org/vuln/ghsa-v436-q368-hvgg GHSA-v436-q368-hvgg — Keycloak has lack of validation of access token on client registrations endpoint 2026-10-03T01:39:14.551039+00:00

Affected: Maven: org.keycloak:keycloak-core

When a service account with the create-client or manage-clients role can use the client-registration endpoints to create/manage clients with an access token.

If the access token is leaked, there is an option to revoke the specific token. However, the check is not performed in client-registration endpoints.

 https://cve.radiocsirt.org/vuln/gsd-2023-0091 gsd-2023-0091 2026-10-03T01:39:14.551065+00:00 gsd-2023-0091 https://cve.radiocsirt.org/vuln/rhsa-2023:1043 RHSA-2023:1043 — Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7 2026-10-03T01:39:14.551077+00:00

bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods glob-parent: Regular Expression Denial of Service minimist: prototype pollution keycloak: HTML injection in execute-actions-email Admin REST API keycloak: XSS on impersonation under specific circumstances SnakeYaml: Constructor Deserialization Remote Code Execution Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations keycloak: Session takeover with OIDC offline refreshtokens keycloak: reflected XSS attack Moment.js: Path traversal in moment.locale snakeyaml: Denial of Service due to missing nested depth limitation for collections moment: inefficient parsing algorithm resulting in DoS loader-utils: Regular expression denial of service snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match jettison: parser crash by stackoverflow jettison: memory exhaustion via user-supplied XML or J…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0034 WID-SEC-W-2023-0034 — Keycloak: Schwachstelle ermöglicht Manipulation von Daten 2026-10-03T01:39:14.551138+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Daten zu manipulieren.