Lucene search
+L

29738 matches found

Vulnrichment
Vulnrichment
added 2026/07/17 4:43 p.m.20 views

CVE-2026-16103 Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption

A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication CIBA initiation handler but were omitted from the token redemption handler. This...

4.3CVSS5.3AI score0.00345EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/07/17 4:43 p.m.17 views

CVE-2026-16103

A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication CIBA initiation handler but were omitted from the token redemption handler. This...

4.3CVSS4.9AI score0.00345EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/17 4:43 p.m.61 views

CVE-2026-16108 Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and...

4.3CVSS0.00212EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/07/17 4:42 p.m.15 views

CVE-2026-16093 Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned...

5.4CVSS5.4AI score0.00393EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/17 3:16 p.m.25 views

CVE-2026-16089

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

5.9CVSS0.00179EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/17 2:15 p.m.76 views

CVE-2026-16089

The CVE-2026-16089 entry describes a vulnerability in Red Hat Build of Keycloak’s keycloak-services, where OAuth 2.0 authorization codes are not properly bound to the client that requested them. If an attacker can intercept an authorization code, they can modify it to be redeemed by their own cli...

5.9CVSS5.4AI score0.00179EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist
added 2026/07/17 2:15 p.m.52 views

CVE-2026-16089 Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

5.4CVSS0.00179EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/17 2:15 p.m.12 views

CVE-2026-16089

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

5.4CVSS5.4AI score0.00179EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/07/17 2:15 p.m.9 views

CVE-2026-16089 Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

5.4CVSS5.4AI score0.00179EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/17 2:15 p.m.28 views

EUVD-2026-45176

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

5.4CVSS5.4AI score0.00179EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/17 1:40 p.m.39 views

CVE-2026-16072

CVE-2026-16072 affects Keycloak’s organization management component. A delegated administrator with org-management permissions can create an invitation for a non-existent email address and then fetch the secret registration link via the API, enabling creation of new user accounts and their additi...

4.9CVSS5.3AI score0.00432EPSS
SaveExploits0References4Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/17 11:49 a.m.16 views

CVE-2026-15943 Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

5.5CVSS5.4AI score0.00337EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/17 11:49 a.m.34 views

CVE-2026-15943

A vulnerability in Keycloak's keycloak-services component affects identity provider management. When a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value, the system performs improper validation and reuses the existing real secret even if fields ...

5.5CVSS5.4AI score0.00337EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/17 8:35 a.m.37 views

CVE-2026-62764

CVE-2026-62764 affects Apache Accumulo 2.1.4 and 2.1.5. An authenticated, low-privilege user without system permissions can remotely issue a command to gracefully shutdown several components (e.g., compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver), causing a denial of ...

6.5CVSS5.4AI score0.00471EPSS
SaveExploits0References5Affected Software1
Fedora
Fedora
added 2026/07/17 12:54 a.m.18 views

[SECURITY] Fedora 44 Update: rust-opendal-0.55.0-2.fc44

OpenDAL is an Open Data Access Layer that enables seamless interaction with diverse storage services...

6.1AI score
SaveExploits0
CVE
CVE
added 2026/07/17 12:07 a.m.32 views

CVE-2026-62234

Grav 2.x prior to 2.0.4 contains an SSRF vulnerability in webhook dispatch where authenticated users with api.webhooks.write can create webhooks using file://, dict://, or gopher:// protocols. This unrestricted protocol handling can be leveraged to read local files, access process information, or...

8.4CVSS6.1AI score0.00395EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/17 12:00 a.m.20 views

PT-2026-60799

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the keycloak-services component. The issue stems from an incomplete implementation of brute-force protection within the Client-Initiated Backchannel Authentication CIBA flow...

4.3CVSS5.2AI score0.00345EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/17 12:00 a.m.30 views

PT-2026-60800

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the authentication configuration endpoint of the keycloak-services component, the core engine for Red Hat Build of Keycloak identity and access management...

6.5CVSS5.9AI score0.00258EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/17 12:00 a.m.27 views

PT-2026-60770

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw in the keycloak-services component occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. This allows an...

5.9CVSS5.9AI score0.00179EPSS
SaveExploits0References6
BDU FSTEC
BDU FSTEC
added 2026/07/17 12:00 a.m.11 views

The vulnerability in the set of Microsoft XML Core Services on the Windows operating system allows a perpetrator to escalate their privileges.

The vulnerability of the Microsoft XML Core Services on the Windows operating system relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow an attacker to increase their privileges...

7CVSS5.3AI score0.00279EPSS
SaveExploits0References2Affected Software18
Rows per page
Query Builder