aella-gateway-admin (>=1.0.5 <=1.0.9), angus-router (>=0.1.0 <=0.1.4) +5 more potentially affected by CVE-2025-9095 via express-gateway (=1.16.11)

express-gateway NPM version =1.16.11 is affected by a known vulnerability. The following packages have a transitive dependency on express-gateway and may be impacted: - aella-gateway-admin =1.0.5, =0.1.0, =1.0.0, =0.0.1, =0.0.5, =0.0.6 - factoria.rae.identity =1.0.0 - wawole-gateway =1.0.0 Source...

MAL-2025-9143 Malicious code in @omisepayments/keycloak-react-components (npm)

The package @omisepayments/keycloak-react-components was found to contain malicious code...

MAL-2025-9238 Malicious code in @pmm/keycloak-factory (npm)

The package @pmm/keycloak-factory was found to contain malicious code...

CVE-2025-8916 vulnerabilities

Vulnerabilities for packages: thingsboard, druid, kserve-modelmesh, zipkin...

GHSA-PRJ3-CCX8-P6X4 vulnerabilities

Vulnerabilities for packages: apicurio-registry, akhq, flyway, infinispan, thingsboard, trino, celeborn, sonarqube, keycloak, wildfly, apache-pulsar, management-api-for-apache-cassandra-5.0, spark, tez, druid, kserve-modelmesh, strimzi-kafka-operator, apache-nifi...

GHSA-4CX2-FC23-5WG6 vulnerabilities

Vulnerabilities for packages: thingsboard, druid, kserve-modelmesh, zipkin...

CVE-2025-55163 vulnerabilities

Vulnerabilities for packages: apicurio-registry, akhq, flyway, infinispan, thingsboard, trino, celeborn, sonarqube, keycloak, wildfly, apache-pulsar, management-api-for-apache-cassandra-5.0, spark, tez, druid, kserve-modelmesh, strimzi-kafka-operator, apache-nifi...

CVE-2025-8916 vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, camunda-zeebe, kayenta-fips, kserve-modelmesh, opensearch, neo4j, hadoop-fips, pinot, elasticsearch, thingsboard, kayenta, pinot-fips, zipkin, logstash, druid...

CVE-2025-55163 vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, apache-nifi, trino, management-api-for-apache-cassandra-4.0, management-api-for-apache-cassandra-4.1, apicurio-registry, localstack, seata, apache-pulsar, kserve-modelmesh, apache-hop-fips, spark, tez, camunda-zeebe, hadoop-fips, keycloak,...

GHSA-4CX2-FC23-5WG6 vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, camunda-zeebe, kayenta-fips, kserve-modelmesh, opensearch, neo4j, hadoop-fips, pinot, elasticsearch, thingsboard, kayenta, pinot-fips, zipkin, logstash, druid...

GHSA-PRJ3-CCX8-P6X4 vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, apache-nifi, trino, management-api-for-apache-cassandra-4.0, management-api-for-apache-cassandra-4.1, apicurio-registry, localstack, seata, apache-pulsar, kserve-modelmesh, apache-hop-fips, spark, tez, camunda-zeebe, hadoop-fips, keycloak,...

com.ascentstream.pulsar:bcfips-include-test (>=3.0.7.0-SNAPSHOT-a030c50 <=3.0.8.0-SNAPSHOT-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.7.0-SNAPSHOT-a030c50 <=4.0.11.0) +13 more potentially affected by CVE-2025-8916 via org.bouncycastle:bcpkix-fips (>=1.0.5 <=2.0.11)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.5, =3.0.7.0-SNAPSHOT-a030c50, =3.0.7.0-SNAPSHOT-a030c50, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =3.1.0, =3.0.0.1, =3.0.0.1, =3.13.14, =3.0.0, =1.0.4, =1.0.0, =19.0.0, =25.0.6 Source cves: CVE-2025-8916 Source advisory:...

com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0 <=9.5.0), org.apache.camel.springboot:camel-opensearch-starter (=4.12.0) +13 more potentially affected by CVE-2025-8885 via org.bouncycastle:bc-fips (=2.0.0)

org.bouncycastle:bc-fips MAVEN version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bc-fips and may be impacted: - com.itextpdf:bouncy-castle-fips-adapter =9.0.0, =3.22.0, =26.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0,...

CVE-2025-7962 vulnerabilities

Vulnerabilities for packages: apicurio-registry, jenkins, keycloak-config-cli, keycloak, wildfly, thingsboard, dependency-track, apache-nifi...

GHSA-9342-92GG-6V29 vulnerabilities

Vulnerabilities for packages: apicurio-registry, jenkins, keycloak-config-cli, keycloak, wildfly, thingsboard, dependency-track, apache-nifi...

GHSA-9342-92GG-6V29 vulnerabilities

Vulnerabilities for packages: wildfly, elasticsearch-fips, apache-nifi, dependency-track, apicurio-registry, thingsboard, elasticsearch, keycloak-config-cli, keycloak, geoserver, jenkins...

CVE-2025-7962 vulnerabilities

Vulnerabilities for packages: wildfly, elasticsearch-fips, apache-nifi, dependency-track, apicurio-registry, thingsboard, elasticsearch, keycloak-config-cli, keycloak, geoserver, jenkins...

Keycloak <= 26.3.2 SMTP Inject (GHSA-qj5r-2r5p-phc7)

The version of Keycloak installed on the remote host is prior or equal to 26.3.2. It is, therefore, affected by SMTP inject vulnerability as reference in GHSA-qj5r-2r5p-phc7 advisory. - A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform...

The vulnerability of the SMTP protocol implementation in the software platform for managing identification and access control in Keycloak allows a perpetrator to execute arbitrary commands.

The vulnerability of the SMTP protocol implementation for managing identities and access control in Keycloak relates to the failure to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references. Original Description A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP...