Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Medium [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction
Google external access-token exchange bypasses hosted-domain restriction. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-18203] Group policy extendChildren matches sibling group path prefixes
Group policy extendChildren matches sibling group path prefixes. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-863. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-18211] secure-client-uris policy bypass via localhost-prefixed domains
secure-client-uris policy bypass via localhost-prefixed domains. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-20. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-18208] Inactive out-of-audience token introspection leaks signed JWT claim
Inactive out-of-audience token introspection leaks signed JWT claim. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess high-level delegated administrative privileges (manage-realm). Successful exploitation allows an attacker to remove child roles from built-in admin roles, leading to a loss of integrity for administrative configurations. The vulnerability's root cause is an incomplete fix for a previous issue, where authorization checks were not consistently applied to name-based REST API endpoints. Affected Red Hat products: Red Hat Build of Keycloak. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant
Microsoft external access-token exchange bypasses configured tenant. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-287. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-18218] Client not-before revocation ignored when realm not-before is older but nonzero
Client not-before revocation ignored when realm not-before is older but nonzero. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-58039] Information disclosure due to improper permission enforcement
Information disclosure due to improper permission enforcement. Red Hat rates this moderate (CVSS 4.4). Weakness: CWE-73. Red Hat lists fixing advisory RHSA-2026:48273 with package nodejs26-main-26.5.1-1.5.hum1, nodejs22-main-22.23.2-2.3.hum1, nodejs24-main-24.18.1-0.1.hum1.
Low [CVE-2026-54787] Signature bypass allows acceptance of bundles signed with expired keys
Signature bypass allows acceptance of bundles signed with expired keys. Red Hat rates this low (CVSS 3.1). Weakness: CWE-347. Red Hat lists fixing advisory RHSA-2026:44162 with package spire1-14-main-1.14.7-0.3.hum1, spire1-15-main-1.15.2-0.3.hum1, trivy-main-0.72.0-0.1.3.hum1.
Low [CVE-2026-18569] OIDC backchannel logout accepts unsigned forged logout tokens
OIDC backchannel logout accepts unsigned forged logout tokens. Red Hat rates this low (CVSS 3.7). Weakness: CWE-347. Affected product named by the advisory: Red Hat Build of Keycloak.
Low [CVE-2026-18209] OIDC redirect_uri fragment bypass in HTTP parameter pollution check
OIDC redirect_uri fragment bypass in HTTP parameter pollution check. Red Hat rates this low (CVSS 3.4). Weakness: CWE-1288.
Low [CVE-2026-18206] Client policy source-host wildcard domain matching bypass
Client policy source-host wildcard domain matching bypass. Red Hat rates this low (CVSS 3.7). Weakness: CWE-20. Affected product named by the advisory: Red Hat Build of Keycloak.
Low [CVE-2026-18217] SAML HTTP-Redirect binding response preserves query string leading to parameter pollution
SAML HTTP-Redirect binding response preserves query string leading to parameter pollution. Red Hat rates this moderate (CVSS 3.4). Weakness: CWE-20.
Critical [CVE-2026-18363] Account compromise via password reset token bypass
Account compromise via password reset token bypass. Red Hat rates this critical (CVSS 9.1). Weakness: CWE-640.
Critical [CVE-2026-44092] Integrity and availability loss via malicious MQTT input injection
Integrity and availability loss via malicious MQTT input injection. Red Hat rates this critical (CVSS 9.1). Weakness: CWE-94.
Critical [CVE-2026-17893] Insufficient validation of untrusted input in Updater
Insufficient validation of untrusted input in Updater. Red Hat rates this moderate (CVSS 9). Weakness: CWE-1286.
Critical [CVE-2026-17890] Insufficient validation of untrusted input in DevTools
Insufficient validation of untrusted input in DevTools. Red Hat rates this moderate (CVSS 9). Weakness: CWE-1286.
Critical [CVE-2026-17848] Insufficient validation of untrusted input in Codecs
Insufficient validation of untrusted input in Codecs. Red Hat rates this moderate (CVSS 9.6). Weakness: CWE-190.
Critical [CVE-2026-17850] Inappropriate implementation in Permissions
Inappropriate implementation in Permissions. Red Hat rates this moderate (CVSS 9.3). Weakness: CWE-346.
Critical [CVE-2026-17832] Use after free in ANGLE
Use after free in ANGLE. Red Hat rates this moderate (CVSS 9). Weakness: CWE-825.