CVE-2026-42584 vulnerabilities

Vulnerabilities for packages: trino, flyway, akhq, thingsboard, kserve-modelmesh, tez, apicurio-registry, apache-nifi, infinispan, neo4j, logstash, apache-nifi-registry, druid, strimzi-kafka-operator, docker-selenium, zipkin, apache-activemq-artemis, opensearch, apache-pulsar, spark, sonarqube,...

CVE-2026-42585 vulnerabilities

Vulnerabilities for packages: trino, flyway, akhq, thingsboard, kserve-modelmesh, tez, apicurio-registry, apache-nifi, infinispan, neo4j, logstash, apache-nifi-registry, druid, strimzi-kafka-operator, docker-selenium, zipkin, apache-activemq-artemis, opensearch, apache-pulsar, spark, sonarqube,...

CVE-2026-7500 vulnerabilities

Vulnerabilities for packages: keycloak, keycloak-fips...

GHSA-HM32-HFMW-RHVG vulnerabilities

Vulnerabilities for packages: keycloak, keycloak-fips...

GHSA-M4CV-J2PX-7723 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, kayenta-fips, apache-pulsar-fips, trino, flyway, keycloak-fips, seata, spark, localstack, nuxeo, apicurio-registry, elasticsearch-fips, elasticsearch, management-api-for-apache-cassandra-4.1, tez, zipkin, kafbat-ui-fips, hono,...

CVE-2026-42585 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, kayenta-fips, apache-pulsar-fips, trino, flyway, keycloak-fips, seata, spark, localstack, nuxeo, apicurio-registry, elasticsearch-fips, elasticsearch, management-api-for-apache-cassandra-4.1, tez, zipkin, kafbat-ui-fips, hono,...

GHSA-38F8-5428-X5CV vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, kayenta-fips, apache-pulsar-fips, trino, flyway, keycloak-fips, seata, spark, localstack, nuxeo, apicurio-registry, elasticsearch-fips, elasticsearch, management-api-for-apache-cassandra-4.1, tez, zipkin, kafbat-ui-fips, hono,...

CVE-2026-42584 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, kayenta-fips, apache-pulsar-fips, trino, flyway, keycloak-fips, seata, spark, localstack, nuxeo, apicurio-registry, elasticsearch-fips, elasticsearch, management-api-for-apache-cassandra-4.1, tez, zipkin, kafbat-ui-fips, hono,...

GHSA-57RV-R2G8-2CJ3 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, kayenta-fips, apache-pulsar-fips, trino, flyway, keycloak-fips, seata, spark, localstack, nuxeo, apicurio-registry, elasticsearch-fips, elasticsearch, management-api-for-apache-cassandra-4.1, tez, zipkin, kafbat-ui-fips, hono,...

GHSA-XXQH-MFJM-7MV9 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, kayenta-fips, apache-pulsar-fips, trino, flyway, keycloak-fips, seata, spark, localstack, nuxeo, apicurio-registry, elasticsearch-fips, elasticsearch, management-api-for-apache-cassandra-4.1, tez, zipkin, kafbat-ui-fips, hono,...

CVE-2026-42581 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, kayenta-fips, apache-pulsar-fips, trino, flyway, keycloak-fips, seata, spark, localstack, nuxeo, apicurio-registry, elasticsearch-fips, elasticsearch, management-api-for-apache-cassandra-4.1, tez, zipkin, kafbat-ui-fips, hono,...

CVE-2026-42580 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, kayenta-fips, apache-pulsar-fips, trino, flyway, keycloak-fips, seata, spark, localstack, nuxeo, apicurio-registry, elasticsearch-fips, elasticsearch, management-api-for-apache-cassandra-4.1, tez, zipkin, kafbat-ui-fips, hono,...

CVE-2026-42198 vulnerabilities

Vulnerabilities for packages: kayenta-fips, flyway, keycloak-fips, seata, nuxeo, apicurio-registry, dependency-track, nacos-docker, hono, apache-hop, camunda-zeebe, dependency-track-apiserver, thingsboard, druid, ghidra, sonarqube, geoserver, kayenta, guacamole-client, camunda, debezium,...

GHSA-98QH-XJC8-98PQ vulnerabilities

Vulnerabilities for packages: kayenta-fips, flyway, keycloak-fips, seata, nuxeo, apicurio-registry, dependency-track, nacos-docker, hono, apache-hop, camunda-zeebe, dependency-track-apiserver, thingsboard, druid, ghidra, sonarqube, geoserver, kayenta, guacamole-client, camunda, debezium,...

com.abavilla:fpi-bot-api (>=1.6.0 <=1.6.2), com.abavilla:fpi-bot-api-parent (>=1.6.0 <=1.6.2) +17 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-keycloak-authorization (>=3.0.0.Alpha1 <=3.20.6)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.0.0.Alpha1, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.0.25, =1.0.25, =1.5.0, =1.5.0, =1.3.1, =1.3.1, =1.3.4, =1.3.7 and more Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420251...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when handling HTTP request paths that have had normalizedPath applied. An attacker can gain unauthorized access to protected resources by appending a semicolon and arbitrary text to the request URL, exploiting...

MAL-2026-3264 Malicious code in @bcs-adapters/keycloak-api-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f764a24270c6884e2f07d786ae252002ce64b35efb380b1dbce85e6af90a8e6 The package @bcs-adapters/keycloak-api-adapter was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview @bcs-adapters/keycloak-api-adapter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in @bcs-adapters/keycloak-api-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f764a24270c6884e2f07d786ae252002ce64b35efb380b1dbce85e6af90a8e6 The package @bcs-adapters/keycloak-api-adapter was found to contain malicious code. Source: ghsa-malware...

GHSA-HM32-HFMW-RHVG Keycloak has a Forced Browsing issue

When Keycloak is started with --features-disabled=account,account-api, the Account REST API is only partially disabled. Five endpoints under the versioned path /account/v1alpha1 remain fully functional — including both read and write operations — because they lack the checkAccountApiEnabled gate...