Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.9 Images Security Update

New images are available for Red Hat build of Keycloak 26.6.9 and Red Hat build of Keycloak 26.6.9 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.9 Security Update

New Red Hat build of Keycloak 26.6.9 packages are available from the Customer Portal Red Hat build of Keycloak 26.6.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes...

keycloak-services: keycloak-services: SAML redirect binding signature bypass via percent-encoded parameter names

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names like %53AMLResponse while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to...

CVE-2026-118663

A flaw was found in node-server. This flaw allows an unauthenticated remote attacker to bypass route middleware, such as authentication checks, and access protected static files within the configured root directory. The vulnerability occurs because the static file serving function decodes request...

Keycloak: Auth Bypass

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names like %53AMLResponse while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to...

CVE-2026-117691

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names like %53AMLResponse while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to...

EUVD-2026-117441

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names like %53AMLResponse while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to...

CVE-2026-121967

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them...

CVE-2026-121967 Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them...

CVE-2026-121967 Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them...

CVE-2026-121967: coder: Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5,…

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them...

CVE-2026-120214 @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

CVE-2026-120214 @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

CVE-2026-120214

The @fastify/http-proxy Fastify plugin (versions 11.6.0 through 11.6.2 ) is vulnerable to a path traversal issue where destination validation normalizes literal backslashes before percent-decoding the request path. This allows a path with encoded backslashes and dot-segments to bypass security ch...

CVE-2026-120214 @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and...

CVE-2014-0094

CVE-2014-0094 For verification. Refer to https://piyolog.hatenadiary.jp/entry/20140417/1397750197, vulhub/java:7u55-jdk tomcat-8.0.5 struts-2.3.16 reproduced. The classLoader is working, but the crucial log is percent-encoded, so it does not lead to RCE Windows version also added but only 7u191...

CVE-2021-41773

CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal & RCE ⚠️ For isolated, educational lab use ONLY. This repository builds a deliberately vulnerable Apache server. Never run it on a live, production, or internet-facing host. Red Team internship project by Team Alpha ITSOLERA — Offensive...

CLEANSTART-2026-GO40948 fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization

Security vulnerability affects the argo-workflows package. fast-uri normalize decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization...

CVE-2026-118664

A flaw was found in decode-uri-component. A remote attacker can trigger a Denial of Service DoS by sending crafted input containing numerous malformed percent-encoded sequences. When processing this input, an inefficient fallback decoding routine consumes excessive processor resources and blocks...

GHSA-QR28-FPJM-WQ7F decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

Summary decodeUriComponent takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. Details When...