GHSA-R5W3-XV2F-J59Q vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin...

CVE-2026-41852 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin...

CVE-2026-41850 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin...

CVE-2026-41848 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin...

GHSA-659M-PX2C-25WJ vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin...

GHSA-9F52-RJQV-25QV vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin...

CVE-2026-41851 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin...

GHSA-WXPP-56Q6-5PCG vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin...

CVE-2026-41852 vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, zipkin, kafbat-ui, apache-activemq, jenkins, camunda-zeebe, apache-camel-karavan-devmode, apache-activemq-fips, camunda, apache-nifi-registry, keycloak-config-cli...

GHSA-9F52-RJQV-25QV vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, zipkin, kafbat-ui, apache-activemq, jenkins, camunda-zeebe, apache-camel-karavan-devmode, apache-activemq-fips, camunda, apache-nifi-registry, keycloak-config-cli...

CVE-2026-41851 vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, zipkin, kafbat-ui, apache-activemq, jenkins, camunda-zeebe, apache-camel-karavan-devmode, apache-activemq-fips, camunda, apache-nifi-registry, keycloak-config-cli...

GHSA-659M-PX2C-25WJ vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, zipkin, kafbat-ui, apache-activemq, jenkins, camunda-zeebe, apache-camel-karavan-devmode, apache-activemq-fips, camunda, apache-nifi-registry, keycloak-config-cli...

CVE-2026-41850 vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, zipkin, kafbat-ui, apache-activemq, jenkins, camunda-zeebe, apache-camel-karavan-devmode, apache-activemq-fips, camunda, apache-nifi-registry, keycloak-config-cli...

CVE-2026-41848 vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, zipkin, kafbat-ui, apache-activemq, jenkins, camunda-zeebe, apache-camel-karavan-devmode, apache-activemq-fips, camunda, apache-nifi-registry, keycloak-config-cli...

GHSA-WXPP-56Q6-5PCG vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, zipkin, kafbat-ui, apache-activemq, jenkins, camunda-zeebe, apache-camel-karavan-devmode, apache-activemq-fips, camunda, apache-nifi-registry, keycloak-config-cli...

GHSA-R5W3-XV2F-J59Q vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, zipkin, kafbat-ui, apache-activemq, jenkins, camunda-zeebe, apache-camel-karavan-devmode, apache-activemq-fips, camunda, apache-nifi-registry, keycloak-config-cli...

Improper Verification of Cryptographic Signature

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the backchannel logout endpoint of the keycloak-services...

CVE-2026-18218

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

CVE-2026-18217

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...

CVE-2026-18214

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This mean...