org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.4), org.keycloak:keycloak-dependencies-server-all (20.0.4) +10 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (20.0.4)

org.keycloak:keycloak-services MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.4 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.11), com.github.vzakharchenko:cisco-radius-plugin (1.4.11) +22 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (21.0.0)

org.keycloak:keycloak-services MAVEN version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.11 -...

fr.cnieg.keycloak:attribute-login-provider (1.4.2), io.phasetwo.keycloak:keycloak-orgs (>=0.53, <=0.57) +24 more potentially affected by CVE-2026-37979 via org.keycloak:keycloak-services (23.0.6)

org.keycloak:keycloak-services MAVEN version 23.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.2 - io.phasetwo.keycloak:keycloak-orgs =0.53, =0.57...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.4), org.keycloak:keycloak-dependencies-server-all (20.0.4) +10 more potentially affected by CVE-2026-37978 via org.keycloak:keycloak-services (20.0.4)

org.keycloak:keycloak-services MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.4 -...

CVE-2026-7860

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...

CVE-2026-7860 Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...

CVE-2026-7860 Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...

com.vaadin:vaadin-maven-plugin (>=23.0.0, <=23.6.9), dev.hilla:hilla-maven-plugin (>=0.0.0, <=1.4.1) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=23.0.0, <=23.6.9)

com.vaadin:flow-maven-plugin MAVEN version =23.0.0, =23.0.0, =0.0.0, =1.4.1 Source cves: CVE-2026-7860 Source advisory: MEND:CVE-2026-7860...

com.vaadin:hilla-maven-plugin (>=24.4.0, <=24.10.3), com.vaadin:vaadin-maven-plugin (>=24.0.0, <=24.10.3) +1 more potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=24.0.0, <=24.10.3)

com.vaadin:flow-maven-plugin MAVEN version =24.0.0, =24.4.0, =24.0.0, =2.0.0, =24.1.15 Source cves: CVE-2026-7860 Source advisory: MEND:CVE-2026-7860...

com.vaadin:hilla-maven-plugin (>=25.0.0, <=25.1.3), com.vaadin:vaadin-maven-plugin (>=25.0.0, <=25.1.4) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=25.0.0, <=25.1.4)

com.vaadin:flow-maven-plugin MAVEN version =25.0.0, =25.0.0, =25.0.0, =25.1.4 Source cves: CVE-2026-7860 Source advisory: MEND:CVE-2026-7860...

com.vaadin:com.vaadin.gradle.plugin (>=23.0.0, <=23.6.9), com.vaadin:flow-gradle-plugin (>=23.0.0, <=23.6.10) +12 more potentially affected by CVE-2026-7860 via com.vaadin:flow-plugin-base (>=23.0.0, <=23.6.10)

com.vaadin:flow-plugin-base MAVEN version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =0.0.2-8-605ce6, =0.0.2-8-605ce6, =0.0.0-24-fcfa64, =0.0.0, =1.4.0-m2, =1.4.0-m2, =2.0.0-m1 - org.geckoprojects.vaadin:org.gecko.vaadin.generator 2.0.0 Source cves: CVE-2026-7860 Source advisory:...

CVE-2026-7860

CVE-2026-7860 describes an information-disclosure risk in Vaadin build tools: Vaadin Maven/Gradle plugins can print the full set of environment variables to build logs when a frontend build fails (non-zero exit). This can expose credentials/secrets in CI logs and artifacts. Affected ranges and fi...

org.keycloak:keycloak-crypto-fips1402 (25.0.3), org.keycloak:keycloak-dependencies-server-all (25.0.3) +12 more potentially affected by CVE-2026-8922 via org.keycloak:keycloak-services (25.0.3)

org.keycloak:keycloak-services MAVEN version 25.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-crypto-fips1402 25.0.3 - org.keycloak:keycloak-dependencies-server-all 25.0....

fr.cnieg.keycloak:attribute-login-provider (1.4.2), io.phasetwo.keycloak:keycloak-orgs (>=0.53, <=0.57) +24 more potentially affected by CVE-2026-8922 via org.keycloak:keycloak-services (23.0.6)

org.keycloak:keycloak-services MAVEN version 23.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.2 - io.phasetwo.keycloak:keycloak-orgs =0.53, =0.57...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.4), org.keycloak:keycloak-dependencies-server-all (20.0.4) +10 more potentially affected by CVE-2026-8922 via org.keycloak:keycloak-services (20.0.4)

org.keycloak:keycloak-services MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.4 -...

CVE-2026-7860: Generation of Error Message Containing Sensitive Information

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...

PT-2026-41882

Name of the Vulnerable Software and Affected Versions Vaadin Maven plugin versions 23.0.0 through 23.6.9 Vaadin Maven plugin versions 24.0.0 through 24.9.16 Vaadin Maven plugin versions 24.10.0 through 24.10.3 Vaadin Maven plugin versions 25.0.0 through 25.0.10 Vaadin Maven plugin versions 25.1.0...

PT-2026-46866

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...

com.github.psi-probe:psi-probe-tomcat85 (3.5.1), org.apache.tomcat:tomcat-catalina-ha (8.5.57) +28 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (8.5.57)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.57 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.github.psi-probe:psi-probe-tomcat85 3.5.1 - org.apache.tomcat:tomcat-catalina-ha 8.5.57 ...

org.apache.openejb.maven:tomee-embedded-maven-plugin (1.7.3), org.apache.openejb:arquillian-tomee-codi-tests (1.7.3) +27 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (7.0.63)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.63 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - org.apache.openejb.maven:tomee-embedded-maven-plugin 1.7.3 -...