GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-iam-fips, crossplane-provider-aws-wafv2, nrdot-collector-k8s, crossplane-provider-aws-sns-fips, crossplane-provider-aws-ec2-fips, crossplane-provider-gcp-fips, crossplane-provider-aws-s3-fips, tempo, crossplane-provider-aws-backup,...

CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

CLEANSTART-2026-WD74020 Security fixes in keycloak 26.6.4-r1

Package keycloak version 26.6.4-r1 fixes 14 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

CLEANSTART-2026-ZA01366 Security fixes in crossplane-provider-keycloak 2.22.1-r2

Package crossplane-provider-keycloak version 2.22.1-r2 fixes 2 vulnerabilities: CVE-2026-56852, CVE-2026-5160...

CLEANSTART-2026-FB06164 Security fixes in crossplane-provider-keycloak-fips 2.22.1-r1

Package crossplane-provider-keycloak-fips version 2.22.1-r1 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...

CLEANSTART-2026-IB33850 Security fixes in crossplane-provider-keycloak-fips 2.21.1-r1

Package crossplane-provider-keycloak-fips version 2.21.1-r1 fixes 2 vulnerabilities: CVE-2026-41178, ghsa-jpcw-4wr7-c3vq...

CLEANSTART-2026-YY19713 Security fixes in keycloak 26.7.0-r1

Package keycloak version 26.7.0-r1 fixes 13 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

Insufficient Session Expiration

Apache Camel Keycloak Component is vulnerable to Insufficient Session Expiration. The vulnerability is due to KeycloakSecurityHelper.parseAndVerifyAccessToken omitting the TokenVerifier.ISACTIVE check, allowing expired or not-yet-valid access tokens to pass signature, subject, and issuer validati...

PT-2026-86069

Package keycloak version 26.6.4-r1 fixes 14 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

PT-2026-86101

Package keycloak version 26.7.0-r1 fixes 13 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

PYSEC-2026-3994

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-68971

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-68971: Missing Authorization

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

PT-2026-105481

Apache Airflow's asset materialization endpoint POST /api/v2/assets/asset id/materialize and the XCom result check on wait dag run until finished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a...

Improper Authorization

Overview org.keycloak:keycloak-authz-policy-common is a KeyCloak AuthZ: Common Policy Providers Affected versions of this package are vulnerable to Improper Authorization via the group policy provider in GroupPolicyProvider.java. An attacker can gain unauthorized access to protected resources by...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.2.6, <=1.4.11), com.github.vzakharchenko:cisco-radius-plugin (>=1.2.5, <=1.4.11) +54 more potentially affected by CVE-2026-19608 via org.keycloak:keycloak-authz-policy-common (>=2.0.0.cr1, <=26.7.5)

org.keycloak:keycloak-authz-policy-common MAVEN version =2.0.0.cr1, =1.2.6, =1.2.5, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =24.3.0.0, =24.3.0.0, =2.5.6-24.0, =0.1.0, =8.1, =1.0.0, =1.1.0 and more Source cves: CVE-2026-19608 Source advisory:...

Exploit for Improper Isolation or Compartmentalization in Redhat Build_Of_Keycloak

CVE-2026-4282-Scanner A non-intrusive, version-based vulnerab...

CVE-2026-40983 vulnerabilities

Vulnerabilities for packages: airbyte-server, apache-nifi, camunda-zeebe, keycloak-fips, dependency-track-apiserver, nacos, airbyte-server-fips, infinispan, zipkin, apicurio-registry-fips, request-9047-keycloak-fips, dependency-track, nacos-docker, keycloak, apicurio-registry...

GHSA-G3PR-3P32-FP23 vulnerabilities

Vulnerabilities for packages: apache-nifi, keycloak-fips, kafka-bridge, camunda-zeebe, dependency-track-apiserver, infinispan, knative-kafka-broker-fips, keycloak, airbyte-server, ontop-fips, airbyte-server-fips, zipkin, apicurio-registry-fips, request-9047-keycloak-fips, dependency-track,...