io.github.johnjcool:keycloak-cas-services (4.4.0.final), org.keycloak:keycloak-authz-policy-common (4.4.0.final) +10 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (4.4.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 4.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.4.0.final -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.8.3-20.0.5, <=0.10.0-20.0.5), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=0.8.3-20.0.5, <=0.10.0-20.0.5) +55 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (20.0.5)

org.keycloak:keycloak-server-spi-private MAVEN version 20.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.8.3-20.0.5,...

fr.cnieg.keycloak:attribute-login-provider (1.4.11), io.phasetwo.keycloak:keycloak-events (>=0.30, <=0.33) +29 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (25.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.11 -...

org.keycloak:keycloak-authz-policy-common (3.2.0.final), org.keycloak:keycloak-authz-policy-drools (3.2.0.final) +13 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (3.2.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 3.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 3.2.0.final -...

org.keycloak:keycloak-authz-policy-common (6.0.0), org.keycloak:keycloak-authz-policy-drools (6.0.0) +15 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (6.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 6.0.0 -...

org.keycloak:keycloak-authz-policy-common (3.4.0.final), org.keycloak:keycloak-authz-policy-drools (3.4.0.final) +13 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (3.4.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 3.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 3.4.0.final -...

de.adorsys.sts:keycloak-storage-provider (>=1.1.23, <=1.1.28), io.phasetwo.keycloak:keycloak-events (0.20) +61 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (22.0.4)

org.keycloak:keycloak-server-spi-private MAVEN version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.1.23, =0.20, =0.12, =8.16.0,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.4), com.github.vzakharchenko:cisco-radius-plugin (1.3.4) +31 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (12.0.3)

org.keycloak:keycloak-server-spi-private MAVEN version 12.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.4 -...

com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider (1.0.0), io.github.pckhoi.keycloak:webhook (19.0.2.1) +30 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (19.0.2)

org.keycloak:keycloak-server-spi-private MAVEN version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider 1.0....

org.keycloak:keycloak-authz-policy-common (4.8.1.final), org.keycloak:keycloak-dependencies-server-min (4.8.1.final) +9 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (4.8.1.final)

org.keycloak:keycloak-server-spi-private MAVEN version 4.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 4.8.1.final -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.0.0-23.0, <=2.5.1-23.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.0.0-23.0, <=2.5.1-23.0) +64 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (23.0.1)

org.keycloak:keycloak-server-spi-private MAVEN version 23.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.0.0-23.0, =2.0.0-23.0,...

USN-8096-4 linux-realtime vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module LSM. An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information kernel memory, local...

USN-8096-1 linux, linux-aws, linux-gcp, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle, linux-xilinx-zynqmp vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module LSM. An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information kernel memory, local...

PT-2026-30169

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained a flaw where controller per-cpu statistics were not allocated until after the controller was registered, creating a window where accessing sysfs attributes cou...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), dk.grinn.keycloak:keycloak-migrate-resource (>=0.0.6, <=1.0.11) +9 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (6.0.1)

org.keycloak:keycloak-services MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =0.0.6, =0.0.6, =1.0.11 -...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the IdentityBrokerService.performLogin endpoin...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +125 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-server-spi-private (>=26.0.0, <=26.2.5)

org.keycloak:keycloak-server-spi-private MAVEN version =26.0.0, =0.0.0, =0.0.0, =0.0.0, =1.0.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =1.1.1-26.0, =1.11.0, =1.11.2 - io.github.jeff-tian:keycloak-phone-provider 2.4.1 - io.github.jeff-tian:keycloak-phone-provider-parent 2.4.1 and more Sour...

com.github.vzakharchenko:rad-sec-plugin (1.6.1), com.github.vzakharchenko:radius-disconnect-plugin (1.6.1) +88 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-server-spi-private (>=26.3.0, <=26.4.7)

org.keycloak:keycloak-server-spi-private MAVEN version =26.3.0, =1.1.0, =1.0.1, =1.1.0, =5.4.4-26.4, =5.4.4-26.4, =2.0.3-26.4, =0.1.0, =1.11.3, =0.7, =0.47, =0.50 and more Source cves: CVE-2026-3009 Source advisory: SNYK:JAVA-ORGKEYCLOAK-15440476...

com.inventage.keycloak.role-based-timeout:keycloak-role-based-timeout (>=1.0.0, <=1.2.0), com.inventage.keycloak.sms-authenticator:keycloak-sms-authenticator (>=1.2.0, <=1.8.1) +81 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-server-spi-private (>=26.5.0, <=26.5.4)

org.keycloak:keycloak-server-spi-private MAVEN version =26.5.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.11.17, =1.1.2, =0.1.1-rc1, =26.1.2-kc26.4.4, =0.6.2, =0.6.5 - io.phasetwo.keycloak:keycloak-account-v1 0.11 and more Source cves: CVE-2026-3009 Source advisor...

com.inventage.keycloak.role-based-timeout:keycloak-role-based-timeout (>=1.0.0, <=1.2.0), com.inventage.keycloak.sms-authenticator:keycloak-sms-authenticator (>=1.2.0, <=1.8.1) +81 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (>=26.5.0, <=26.5.4)

org.keycloak:keycloak-server-spi-private MAVEN version =26.5.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.11.17, =1.1.2, =0.1.1-rc1, =26.1.2-kc26.4.4, =0.6.2, =0.6.5 - io.phasetwo.keycloak:keycloak-account-v1 0.11 and more Source cves: CVE-2026-2603 Source advisor...