Skip to contentRed Hat Single Sign-on vulnerabilities
- isaacs node-tar, tar, red hat cryostat 4 +20 more +22 morenode-tar: Hardlink Path Traversal via Drive-Relative LinkpathCVE-2026-29786Public exploitFix available8.2 High
- svg svgo, red hat cryostat 4, gatekeeper 3 +45 more +47 moreSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074Fix available7.5 High
- apache artemis, apache software foundation activemq artemis, red hat amq broker 7.12.6 +17 more +19 moreApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationCVE-2026-27446Fix availableEPSS 11.4%9.3 Critical
- redhat keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.9 +4 more +6 moreOrg.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administratorsCVE-2026-0871Fix available4.9 Medium
- rollup, red hat openshift pipelines, openshift service mesh 3 +26 more +28 moreRollup 4 has Arbitrary File Write via Path TraversalCVE-2026-27606Public exploitFix available8.8 High
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.10 +3 more +5 moreOrg.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocolCVE-2026-27333.8 Low
- ajv.js ajv, red hat confidential compute attestation, cryostat 4 +67 more +69 moreajv has ReDoS when using `$data` optionCVE-2025-69873Fix available2.9 Low
- red hat build of apicurio registry 2, build of quarkus, data grid 8 +7 more +9 moreUndertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacksCVE-2024-4027Fix available7.5 High
- isaacs node-tar, tar, red hat cryostat 4 +27 more +29 morenode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalCVE-2026-24842Fix available8.2 High
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdataCVE-2026-11903.1 Low
- red hat amq broker 7, build of optaplanner 8, data grid 8 +20 more +22 moreOrg.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionCVE-2026-0603Public exploitFix available8.3 High
- cli, red hat confidential compute attestation, cryostat 4 +32 more +34 morenpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityCVE-2026-0775Fix available7.0 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race conditionCVE-2026-10353.1 Low
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.11 +3 more +5 moreOrg.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uriCVE-2026-11805.8 Medium
- isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 morenode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSCVE-2026-23950Fix available8.8 High
- @tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 moreReact Router vulnerable to XSS via Open RedirectsCVE-2026-22029Fix available8.0 High
- @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 moreReact Router has Path Traversal in File Session StorageCVE-2025-61686Public exploitFix availableEPSS 17.3%9.1 Critical
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +33 more +35 moreUndertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrfCVE-2025-12543Fix available9.6 Critical
- red hat openshift serverless, build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +29 more +31 moreUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedCVE-2024-3884Fix available7.5 High
- red hat single sign-on 7Rhsso: open redirectCVE-2025-127896.1 Medium
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.2 for spring boot 3.5.8 +32 more +34 moreUndertow: undertow madeyoureset http/2 ddos vulnerabilityCVE-2025-9784Public exploitFix available7.5 High
- red hat build of keycloak 26, build of keycloak 26.2, jboss enterprise application platform 8 +3 more +5 moreOrg.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)CVE-2025-7784Fix available6.5 Medium
- red hat build of keycloak, build of keycloak 26, build of keycloak 26.0 +2 more +4 moreOrg.keycloak.protocol.services: keycloak hostname verificationCVE-2025-3501Fix available8.2 High
- red hat build of keycloak, build of keycloak 26.0, single sign-on 7 +2 moreOrg.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloakCVE-2025-25594.9 Medium
- red hat build of keycloak, data grid 8, fuse 7 +13 more +15 moreOrg.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cliCVE-2025-23368Fix available8.1 High
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-core: stored xss in keycloak when creating a items in admin consoleCVE-2024-40283.8 Low
- redhat wildfly, red hat build of keycloak, data grid 8 +14 more +16 moreOrg.wildfly.core:wildfly-server: wildfly improper rbac permissionCVE-2025-23367Fix available6.5 Medium
- red hat build of keycloak, build of keycloak 26.0, single sign-on 7 +2 moreKeycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloakCVE-2025-0604Fix available5.4 Medium
- red hat .net 6.0 on red hat enterprise linux, cryostat 3, logging subsystem for red hat openshift +52 more +54 moreNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptCVE-2024-11831Fix available5.4 Medium
- red hat build of keycloak 24, build of keycloak 24.0.9, build of keycloak 26.0 +4 more +6 moreKeycloak-quarkus-server: keycloak path trasversalCVE-2024-10492Fix available2.7 Low
- red hat build of keycloak 24, build of keycloak 24.0.9, build of keycloak 26.0 +3 more +5 moreOrg.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build processCVE-2024-10451Fix available5.9 Medium
- red hat build of keycloak 24, build of keycloak 24.0.9, build of keycloak 26.0 +4 more +6 moreOrg.keycloak:keycloak-services: keycloak denial of serviceCVE-2024-10270Fix available6.5 Medium
- hibernate hibernate-validator, red hat a-mq clients 2, cryostat 2 +29 more +31 moreHibernate-validator: rendering of invalid html with safehtml leads to html injection and xssCVE-2023-1932Fix available6.1 Medium
- red hat build of keycloak, fuse 7, jboss data grid 7 +14 more +16 moreWildfly: wildfly vulnerable to cross-site scripting (xss)CVE-2024-10234Fix available6.1 Medium
- red hat migration toolkit for applications 6, migration toolkit for runtimes 1 on rhel 8, build of apache camel for spring boot 3 +21 more +23 moreUndertow: cookie smuggling/spoofingCVE-2023-4639Fix available7.4 High
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +13 more +15 moreKeycloak: vulnerable redirect uri validation results in open redirecCVE-2024-8883Fix available6.1 Medium
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +8 more +10 moreKeycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloakCVE-2024-8698Public exploitFix available7.7 High
- redhat keycloak, red hat build of quarkus, fuse 7 +6 more +8 moreKeycloak: amount of attributes per object is not limited and it may lead to dosCVE-2023-6841Fix available7.5 High
- redhat keycloak, red hat build of keycloak, build of keycloak 22 +8 more +10 moreWildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adaptersCVE-2024-7341Fix available7.1 High
- redhat keycloak, red hat build of keycloak, build of keycloak 22 +11 more +13 moreKeycloak: potential bypass of brute force protectionCVE-2024-4629Fix available6.5 Medium
- red hat hawtio 4.0.0 for red hat build of apache camel 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.2 for spring boot +26 more +28 moreUndertow: improper state management in proxy protocol parsing causes information leakageCVE-2024-7885Fix available7.5 High
- red hat openshift serverless, build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +21 more +23 moreUndertow: learningpushhandler can lead to remote memory dos attacksCVE-2024-3653Fix available5.3 Medium
- red hat build of apache camel - hawtio 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.1 for spring boot 3.2 +17 more +19 moreUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketCVE-2024-5971Fix available7.5 High
- red hat eap 8.0.1, build of apache camel - hawtio 4, build of apache camel 4.4.1 for spring boot 3.2 +11 more +13 moreUndertow: url-encoded request path information can be broken on ajp-listenerCVE-2024-6162Fix available7.5 High
- red hat build of keycloak, build of keycloak 22, single sign-on 7 +4 more +6 moreKeycloak: leak of configured ldap bind credentials through the keycloak admin consoleCVE-2024-5967Fix available2.7 Low
- red hat build of keycloak, jboss enterprise application platform 8, single sign-on 7 +2 moreKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesCVE-2024-3656Public exploitFix available8.1 High
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +5 more +7 moreKeycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookieCVE-2024-4540Fix available7.5 High
- red hat build of keycloak, data grid 8, fuse 7 +11 more +13 moreWildfly: no timeout for eap management interface may lead to denial of service (dos)CVE-2024-40294.1 Medium
- jberet, red hat build of keycloak, data grid 8 +11 more +13 moreJberet: jberet-core logging database credentialsCVE-2024-1102Fix available6.5 Medium
- Show moreLoading…