EUVD-2026-61871

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware component: Web Services Security. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise...

EUVD-2026-61869

Vulnerability in the Oracle Financial Services Enterprise Case Management product of Oracle Financial Services Applications component: Web UI. Supported versions that are affected are 8.0.8.2 and 8.1.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...

EUVD-2026-61300

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware component: Web Services Security. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

EUVD-2026-61415

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware component: Web Services Security. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

EUVD-2026-61410

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (26.7.3.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (26.7.3.0) +74 more potentially affected by CVE-2026-15571 via org.keycloak:keycloak-services (>=26.7.0, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =26.7.0, =6.0.0, =6.0.0, =2.8.4, =3.0.0, =0.7.0, =2.3.0, =1.11.30, =1.3.0, =0.1.3, =1.3.0, =2.2.7, =2.2.8 and more Source cves: CVE-2026-15571 Source advisory: MEND:CVE-2026-15571...

keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +141 more potentially affected by CVE-2026-15571 via org.keycloak:keycloak-services (>=26.0.0, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.0.0, =1.0.0, =1.2.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-15571 Source advisory: SNYK:JAVA-ORGKEYCLOAK-19233601https://vulners.com/snyk/SNYK:JAVA-ORGKEYCLOAK-192...

CVE-2026-70666 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

com.inventage.keycloak.log-level:keycloak-log-level (1.0.0), com.inventage.keycloak.role-based-timeout:keycloak-role-based-timeout (>=1.0.0, <=1.2.0) +92 more potentially affected by CVE-2026-18963 via org.keycloak:keycloak-services (>=26.5.0, <=26.6.4)

org.keycloak:keycloak-services MAVEN version =26.5.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.11.17, =1.1.2, =1.2.7 and more Source cves: CVE-2026-18963 Source advisory: GHSA-4GV3-MC9P-5WQC...

com.inventage.keycloak.log-level:keycloak-log-level (1.0.0), com.inventage.keycloak.role-based-timeout:keycloak-role-based-timeout (>=1.0.0, <=1.2.0) +92 more potentially affected by CVE-2026-18963 via org.keycloak:keycloak-services (>=26.5.0, <=26.6.4)

org.keycloak:keycloak-services MAVEN version =26.5.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.11.17, =1.1.2, =1.2.7 and more Source cves: CVE-2026-18963 Source advisory: OSV:GHSA-4GV3-MC9P-5WQC...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (26.7.3.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (26.7.3.0) +74 more potentially affected by CVE-2026-18963 via org.keycloak:keycloak-services (>=26.7.0, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =26.7.0, =6.0.0, =6.0.0, =2.8.4, =3.0.0, =0.7.0, =2.3.0, =1.11.30, =1.3.0, =0.1.3, =1.3.0, =2.2.7, =2.2.8 and more Source cves: CVE-2026-18963 Source advisory: GHSA-4GV3-MC9P-5WQC...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (26.7.3.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (26.7.3.0) +74 more potentially affected by CVE-2026-18963 via org.keycloak:keycloak-services (>=26.7.0, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =26.7.0, =6.0.0, =6.0.0, =2.8.4, =3.0.0, =0.7.0, =2.3.0, =1.11.30, =1.3.0, =0.1.3, =1.3.0, =2.2.7, =2.2.8 and more Source cves: CVE-2026-18963 Source advisory: OSV:GHSA-4GV3-MC9P-5WQC...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +101 more potentially affected by CVE-2026-18963 via org.keycloak:keycloak-services (>=26.0.0, <=26.4.7)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =1.1.1-26.0, =0.1.0, =1.4.0 and more Source cves: CVE-2026-18963 Source advisory: GHSA-4GV3-MC9P-5WQC...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +101 more potentially affected by CVE-2026-18963 via org.keycloak:keycloak-services (>=26.0.0, <=26.4.7)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =1.1.1-26.0, =0.1.0, =1.4.0 and more Source cves: CVE-2026-18963 Source advisory: OSV:GHSA-4GV3-MC9P-5WQC...

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (26.7.3.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (26.7.3.0) +74 more potentially affected by CVE-2026-18963 via org.keycloak:keycloak-services (>=26.7.0, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =26.7.0, =6.0.0, =6.0.0, =2.8.4, =3.0.0, =0.7.0, =2.3.0, =1.11.30, =1.3.0, =0.1.3, =1.3.0, =2.2.7, =2.2.8 and more Source cves: CVE-2026-18963 Source advisory: MEND:CVE-2026-18963...

com.github.vzakharchenko:radius-disconnect-plugin (1.6.1), com.github.vzakharchenko:radius-plugin (1.6.1) +65 more potentially affected by CVE-2026-18963 via org.keycloak:keycloak-services (>=26.4.0, <=26.4.7)

org.keycloak:keycloak-services MAVEN version =26.4.0, =5.4.4-26.4, =5.4.4-26.4, =2.0.3-26.4, =0.1.0, =1.11.9, =0.119, =2.1.10, =8.10, =8.10, =8.12 and more Source cves: CVE-2026-18963 Source advisory: MEND:CVE-2026-18963...

CVE-2026-18963

A critical flaw in the reset-credentials flow of Keycloak 26.0.0–26.7.1 allows an unauthenticated attacker to force a password reset for any user—including administrators—without clicking the required email verification link, enabling full account takeover . The root cause involves two chained de...