CVE-2026-8458

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When...

EUVD-2026-41489

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpieimportuploadfilefromurl AJAX action. The plugin's URL downloader first calls wpsaferemoteget which correctly blocks private/reserved IP ranges, but wh...

CVE-2026-10055: Server-Side Request Forgery (SSRF)

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the...

PT-2026-55551

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Fine-Grained Admin Permissions FGAP v2 implementation within the administrative services. When FGAP v2 is enabled, the system does not correctly filter child groups base...

io.kokuwa.keycloak:keycloak-event-metrics (0.2.1), org.keycloak:keycloak-crypto-fips1402 (21.1.0) +13 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (21.1.0)

org.keycloak:keycloak-services MAVEN version 21.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics 0.2.1 - org.keycloak:keycloak-crypto-fips1402 21.1.0 -...

org.keycloak:keycloak-account-freemarker (1.0-beta-2), org.keycloak:keycloak-login-freemarker (1.0-beta-2) potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0-beta-2)

org.keycloak:keycloak-services MAVEN version 1.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-2 - org.keycloak:keycloak-login-freemarker...

fr.cnieg.keycloak:attribute-login-provider (1.3.4), io.phasetwo.keycloak:keycloak-orgs (>=0.24, <=0.27) +25 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (21.0.2)

org.keycloak:keycloak-services MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.4 - io.phasetwo.keycloak:keycloak-orgs =0.24, =2.5,...

org.keycloak:keycloak-dependencies-server-all (1.9.0.cr1), org.keycloak:keycloak-dependencies-server-min (1.9.0.cr1) +2 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.9.0.cr1)

org.keycloak:keycloak-services MAVEN version 1.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.0.cr1 -...

fr.cnieg.keycloak:attribute-login-provider (1.3.11), io.github.jeff-tian:keycloak-services-social-weixin (>=0.5.35, <=0.5.40) +15 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (23.0.0)

org.keycloak:keycloak-services MAVEN version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.11 -...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (26.7.3.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (26.7.3.0) +115 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (>=26.5.0, <=26.8.0)

org.keycloak:keycloak-services MAVEN version =26.5.0, =1.0.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.4.0 and more Source cves: CVE-2026-2092 Source advisory: OSV:GHSA-794G-X443-36F7https://vulners...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.0.0-23.0, <=2.5.1-23.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.0.0-23.0, <=2.5.1-23.0) +28 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (23.0.1)

org.keycloak:keycloak-services MAVEN version 23.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.0.0-23.0, =2.0.0-23.0, =0.19, =0.16, =4.2,...

org.keycloak:keycloak-account-freemarker (1.1.0.beta2), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta2) +1 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.1.0.beta2)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta2 -...

org.keycloak:keycloak-dependencies-server-all (1.9.7.final), org.keycloak:keycloak-dependencies-server-min (1.9.7.final) +2 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.9.7.final)

org.keycloak:keycloak-services MAVEN version 1.9.7.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.7.final -...

fr.cnieg.keycloak:attribute-login-provider (1.4.5), io.github.opentdf.keycloak:keycloak-opentdf-extension (1.1.0) +28 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (24.0.1)

org.keycloak:keycloak-services MAVEN version 24.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.5 -...

fr.cnieg.keycloak:attribute-login-provider (1.4.2), io.phasetwo.keycloak:keycloak-orgs (>=0.53, <=0.57) +24 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (23.0.6)

org.keycloak:keycloak-services MAVEN version 23.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.2 - io.phasetwo.keycloak:keycloak-orgs =0.53, =0.57...

net.micedre.keycloak:keycloak-mail-whitelisting (1.5), org.keycloak:keycloak-dependencies-server-all (19.0.0) +15 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (19.0.0)

org.keycloak:keycloak-services MAVEN version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - net.micedre.keycloak:keycloak-mail-whitelisting 1.5 - org.keycloak:keycloak-dependencies-server-al...

org.keycloak:keycloak-dependencies-server-all (1.9.5.final), org.keycloak:keycloak-dependencies-server-min (1.9.5.final) +2 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.9.5.final)

org.keycloak:keycloak-services MAVEN version 1.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.5.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.3), org.keycloak:keycloak-account-freemarker (1.0.5.final) +4 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (1.0.5.final)

org.keycloak:keycloak-services MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.3 -...

org.keycloak:keycloak-authz-policy-drools (2.5.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.5.0.cr1) +5 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (2.5.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.0.cr1 -...

com.kleegroup.accelerator:accelerator-message-keycloakbrevo (>=1.0.1, <=1.0.2), com.kleegroup.accelerator:accelerator-security-keycloakmfa (1.0.1) +17 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (24.0.3)

org.keycloak:keycloak-services MAVEN version 24.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.kleegroup.accelerator:accelerator-message-keycloakbrevo =1.0.1, =1.4.7, =1.4.8 -...