Known vulnerabilities in Red Hat build of Keycloak - page 3

Vendor: Red Hat Inc.
Software: Red Hat build of Keycloak
Software CPE: cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*
Website: https://www.redhat.com/en
Total vulnerabilities: 161
Public exploits: 5
Known exploited (KEV): 2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Red Hat build of Keycloak Red Hat build of Keycloak is affected by 161 known vulnerabilities: 1 critical, 11 high, 69 medium, 80 low Critical High Medium Low

Vulnerabilities (161)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU148980 - Allocation of Resources Without Limits or Throttling
CVE-2026-6860		 CWE-770 Medium
No
No
 26.4.13, 26.6.4 11.09.2026 SB2026091123
SB2026091128
SB2026092190
and 1 more
#VU148978 - Out-of-bounds read
CVE-2026-9803		 CWE-125 Medium
No
No
 26.4.13, 26.6.3 11.09.2026 SB2026091122
SB2026091128
#VU148935 - Improper Access Control
CVE-2026-3429		 CWE-284 Low
No
No
 26.4.11 10.09.2026 SB2026091062
SB2026091121
#VU148934 - Improper Access Control
CVE-2025-14083		 CWE-284 Low
No
No
 26.4.11 10.09.2026 SB2026091062
SB2026091121
#VU148930 - Server-Side Request Forgery (SSRF)
CVE-2026-1180		 CWE-918 Low
No
No
 26.4.11 10.09.2026 SB2026091061
SB2026091121
#VU148932 - Incorrect Authorization
CVE-2026-3190		 CWE-863 Low
No
No
 26.4.11 10.09.2026 SB2026091061
SB2026091121
#VU148927 - Authorization Bypass Through User-Controlled Key
CVE-2025-14777		 CWE-639 Low
No
No
 26.4.11 10.09.2026 SB2026091061
SB2026091121
#VU148926 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-1035		 CWE-367 Low
No
No
 26.4.11 10.09.2026 SB2026091061
SB2026091121
#VU146997 - Missing Authorization
CVE-2026-9088		 CWE-862 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146992 - Incorrect Authorization
CVE-2026-9791		 CWE-863 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146990 - Authorization Bypass Through User-Controlled Key
CVE-2026-9087		 CWE-639 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146989 - Use of Client-Side Authentication
CVE-2026-8830		 CWE-603 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146988 - Incorrect Implementation of Authentication Algorithm
CVE-2026-8922		 CWE-303 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146987 - Direct Request ('Forced Browsing')
CVE-2026-7500		 CWE-425 Medium
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146986 - Improper input validation
CVE-2026-37977		 CWE-20 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU146985 - Server-Side Request Forgery (SSRF)
CVE-2026-4874		 CWE-918 Low
No
No
 26.4.13, 26.6.3 05.09.2026 SB2026090517
SB2026091122
SB2026091128
#VU135697 - Authorization Bypass Through User-Controlled Key
CVE-2026-9099		 CWE-639 Low
No
No
 26.4.13, 26.6.4 29.06.2026 SB2026062907
SB2026091128
#VU135696 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-9083		 CWE-22 Low
No
No
 26.4.13, 26.6.4 29.06.2026 SB2026062907
SB2026091128
#VU135693 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-9086		 CWE-79 Low
No
No
 26.4.13, 26.6.4 29.06.2026 SB2026062907
SB2026091128
#VU135687 - Improper Verification of Cryptographic Signature
CVE-2026-11800		 CWE-347 Medium
No
No
 26.6.4 29.06.2026 SB2026062907
SB2026091128


Showing elements 41 - 60 out of 161