https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:14:48.157713+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-264205 EUVD-2026-264205 2026-10-04T03:14:48.207531+00:00 EUVD-2026-264205 https://cve.radiocsirt.org/vuln/fkie_cve-2025-11538 fkie_cve-2025-11538 2026-10-04T03:14:48.207566+00:00

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

 https://cve.radiocsirt.org/vuln/ghsa-j4vq-q93m-4683 GHSA-j4vq-q93m-4683 — Keycloak has debug default bind address 2026-10-04T03:14:48.207601+00:00

Affected: Maven: org.keycloak:keycloak-quarkus-dist

A vulnerability exists in Keycloak's server distribution where enabling debug mode (`--debug`) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (`0.0.0.0`). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

Red Hat evaluates this as a Moderate impact vulnerability due to the requirement of running debug mode and untrusted network. Also, for Red Hat Single Sign-On, this must as well be bound to 0.0.0.0 address, which is not recommended in production scenarios.

 https://cve.radiocsirt.org/vuln/jvndb-2026-026852 jvndb-2026-026852 2026-10-04T03:14:48.207629+00:00

Multiple vulnerabilities exist in Hitachi Ops Center Common Services. CVE-2025-10939, CVE-2025-11537, CVE-2025-11538, CVE-2025-12110, CVE-2025-13467, CVE-2025-13881, CVE-2025-14082, CVE-2025-14083, CVE-2025-14777, CVE-2025-66560, CVE-2026-0707, CVE-2026-0871, CVE-2026-0976, CVE-2026-1035, CVE-2026-1190, CVE-2026-2092, CVE-2026-2575, CVE-2026-2673, CVE-2026-3009, CVE-2026-3121, CVE-2026-3429, CVE-2026-3872, CVE-2026-3911, CVE-2026-4282, CVE-2026-4325, CVE-2026-4634, CVE-2026-22745, CVE-2026-22748, CVE-2026-25854, CVE-2026-40972, CVE-2026-40975

 https://cve.radiocsirt.org/vuln/rhsa-2025:21370 RHSA-2025:21370 — Red Hat Security Advisory: Red Hat build of Keycloak 26.4.4 Security Update 2026-10-04T03:14:48.207650+00:00

org.keycloak/keycloak-quarkus-server: Unable to restrict access to the admin console keycloak-server: Debug default bind address keycloak: org.keycloak:keycloak-services: User can refresh offline session even after client's offline_access scope was removed org.keycloak/keycloak-services: WebAuthn Attestation Statement Verification Bypass org.keycloak.protocol.oidc.endpoints.LogoutEndpoint: Offline Session takeover due to reused Authentication Session ID

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2606 WID-SEC-W-2025-2606 — Keycloak: Mehrere Schwachstellen 2026-10-04T03:14:48.207672+00:00

Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um beliebigen Programmcode auszuführen, und um Sicherheitsvorkehrungen zu umgehen.