xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release

I have a minimized safe Rust witness for xxhash-rust 0.8.15. Safe public route: xxhashrust::xxh3::xxh364withsecret&0x41, & The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debugassert!. Release-Miri...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-9088 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-9803 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-common (3.1.0.final) +12 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-server-spi-private (3.1.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-9793 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-9689 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-7507 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-4630 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-37981 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-37979 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-37978 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-4282 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-4325 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

CVE-2026-33503

Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the ListCourierMessages Admin API in Ory Kratos is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configur...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-common (3.1.0.final) +12 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-server-spi-private (3.1.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

CVE-2026-33505

Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...