org.keycloak:keycloak-servlet-oauth-client (1.0-alpha-1), org.keycloak:keycloak-undertow-adapter (1.0-alpha-1) potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-alpha-1)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-servlet-oauth-client 1.0-alpha-1 -...

org.keycloak:keycloak-installed-adapter (1.5.1.final), org.keycloak:keycloak-jaxrs-oauth-client (1.5.1.final) +30 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.5.1.final)

org.keycloak:keycloak-adapter-core MAVEN version 1.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed-adapter 1.5.1.final -...

org.keycloak:keycloak-fuse-adapter-dist (3.1.0.cr1), org.keycloak:keycloak-installed-adapter (3.1.0.cr1) +37 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (3.1.0.cr1)

org.keycloak:keycloak-adapter-core MAVEN version 3.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-fuse-adapter-dist 3.1.0.cr1 -...

com.kumuluz.ee.security:kumuluzee-security-keycloak (>=1.0.0, <=1.0.1), org.keycloak:keycloak-fuse-adapter-dist (3.2.1.final) +37 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (3.2.1.final)

org.keycloak:keycloak-adapter-core MAVEN version 3.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.kumuluz.ee.security:kumuluzee-security-keycloak =1.0.0, =1.0.1 -...

org.keycloak:keycloak-installed-adapter (22.0.0), org.keycloak:keycloak-jakarta-servlet-filter-adapter (22.0.0) +18 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (22.0.0)

org.keycloak:keycloak-adapter-core MAVEN version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed-adapter 22.0.0 -...

org.eclipse.dirigible:dirigible-application (8.18.9), org.eclipse.dirigible:dirigible-components-security-keycloak (8.18.9) +19 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (23.0.2)

org.keycloak:keycloak-adapter-core MAVEN version 23.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.eclipse.dirigible:dirigible-application 8.18.9 -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (3.0.0), de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak (>=2.0.13, <=2.3.1) +26 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (23.0.6)

org.keycloak:keycloak-adapter-core MAVEN version 23.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 3.0.0 -...

org.hawkular.accounts:hawkular-accounts-distribution (>=1.0.6, <=1.0.16.final), org.hawkular.agent:hawkular-agent-itest-dist (>=0.6.0.final, <=0.12.0.final) +35 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.3.1.final)

org.keycloak:keycloak-adapter-core MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.hawkular.accounts:hawkular-accounts-distribution =1.0.6, =0.6.0.final,...

org.keycloak:keycloak-jboss-adapter-core (1.0-alpha-4), org.keycloak:keycloak-servlet-oauth-client (1.0-alpha-4) +2 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-alpha-4)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-alpha-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-jboss-adapter-core 1.0-alpha-4 -...

MiracleLinux 9 : grafana-7.5.11-5.el9 (AXSA:2022-4099:05)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2022-4099:05 advisory. grafana: OAuth account takeover CVE-2022-31107 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory. Note...

MiracleLinux 9 : curl-7.76.1-14.el9.4.ML.1 (AXSA:2022-4366:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4366:04 advisory. curl: OAUTH2 bearer bypass in connection re-use CVE-2022-22576 curl: credential leak on redirect CVE-2022-27774 curl: auth/cookie leak on redirect...

MiracleLinux 8 : grafana-9.2.10-7.el8.ML.1 (AXSA:2023-7309:12)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-7309:12 advisory. grafana: account takeover possible when using Azure AD OAuth CVE-2023-3128 Tenable has extracted the preceding description block directly from the MiracleLin...

MiracleLinux 9 : grafana-9.0.9-3.el9 (AXSA:2023-6225:07)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-6225:07 advisory. grafana: account takeover possible when using Azure AD OAuth CVE-2023-3128 Tenable has extracted the preceding description block directly from the MiracleLin...

UBUNTU-CVE-2026-22797

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The externaloauth2token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged...

CVE-2026-21618

Summary: CVE-2026-21618 is an XSS vulnerability in hexpm (hexpm/hexpm) affecting Elixir HexpmWeb.SharedAuthorizationView. The issue stems from improper input neutralization in web page generation, specifically in lib/hexpm_web/views/shared_authorization_view.ex and the function render_grouped_sco...

CVE-2026-21618 Cross-site scripting (XSS) in OAuth Device Authorization screen

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in hexpm hexpm/hexpm 'Elixir.HexpmWeb.SharedAuthorizationView' modules allows Cross-Site Scripting XSS. This vulnerability is associated with program files...

EUVD-2026-3202

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The externaloauth2token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged...

CVE-2025-14524

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host...

SUSE CVE-2017-18897

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection...

Malicious Package

Overview oe-oauth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...