Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how redhat compares to other vendors in security performance

View Risk Score →

Software

redhat enterprise linux
1276
redhat enterprise linux desktop
889
redhat enterprise linux server
840
redhat enterprise linux workstation
808
redhat enterprise linux server aus
550
redhat enterprise linux server tus
436
redhat enterprise linux eus
387
redhat enterprise linux server eus
320
redhat linux
237
redhat openshift container platform
205
redhat jboss enterprise application platform
148
redhat satellite
108
redhat build of keycloak
107
redhat openstack
91
redhat fedora core
81
redhat enterprise linux for ibm z systems
78
redhat single sign-on
74
redhat enterprise linux for power little endian
70
redhat linux advanced workstation
68
redhat enterprise linux for power little endian eus
64
redhat virtualization
64
redhat enterprise linux for ibm z systems eus
63
redhat software collections
60
redhat virtualization host
52
redhat hardened images
47
redhat enterprise linux server for power little endian update services for sap solutions
46
redhat keycloak
45
redhat openshift
40
redhat enterprise linux for arm 64
39
redhat enterprise linux for real time
36
redhat enterprise mrg
35
redhat enterprise linux for arm 64 eus
33
redhat ansible tower
32
redhat enterprise linux hpc node
32
redhat jboss core services
31
redhat enterprise linux for real time for nfv
30
redhat undertow
29
redhat codeready linux builder
25
redhat enterprise linux for power big endian
25
redhat directory server
24
redhat enterprise linux server update services for sap solutions
24
redhat libvirt
24
redhat jboss enterprise web server
23
redhat enterprise linux aus
22
redhat enterprise linux for scientific computing
22
redhat enterprise linux update services for sap solutions
22
redhat fuse
22
redhat jboss fuse
22
redhat 389 directory server
20
redhat ansible automation platform
20

Keycloak KeycloakKeycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow

Risk 60
Severity
8.1
First published (updated )
CVE-2026-18967

redhat Enterprise Linux389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account

Risk 34
Severity
5.4
First published (updated )
CVE-2026-18651

KeycloakKeycloak-services: keycloak-services: client access-type policy condition bypass during client update

Risk 38
Severity
6.5
First published (updated )
CVE-2026-18573

Keycloak KeycloakKeycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes

Risk 38
Severity
6.5
First published (updated )
CVE-2026-18572

Keycloak KeycloakKeycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

Risk 66
Severity
7.2
First published (updated )
CVE-2026-18571
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

keycloak-servicesKeycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed

Risk 34
Severity
5.4
First published (updated )
CVE-2026-18570

Keycloak keycloak-servicesKeycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens

Risk 20
Severity
3.7
First published (updated )
CVE-2026-18569

redhat Enterprise LinuxTar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Risk 25
Severity
4.4
First published (updated )
CVE-2026-18477

Project-koku/koku-metrics-operatorProject-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url

Risk 37
Severity
6.8
First published (updated )
CVE-2026-18382

koku-metrics-operatorProject-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

Risk 47
Severity
7.6
First published (updated )
CVE-2026-18381
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

keycloak-servicesKeycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

Risk 34
Severity
5.4
First published (updated )
CVE-2026-18218

Keycloak KeycloakKeycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

Risk 24
Severity
4.7
First published (updated )
CVE-2026-18217

Microsoft Keycloak social identity provider in Keycloak (Microsoft external identity provider)Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant

Risk 60
Severity
8.1
First published (updated )
CVE-2026-18215

Keycloak Keycloak Google Identity Provider (external access-token exchange)Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction

Risk 60
Severity
8.1
First published (updated )
CVE-2026-18214

Keycloak KeycloakKeycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching

Risk 38
Severity
6.5
First published (updated )
CVE-2026-18207
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Keycloak secure-client-uris (client policy executor)Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains

Risk 34
Severity
5.4
First published (updated )
CVE-2026-18211

Keycloak keycloak-servicesKeycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

Risk 24
Severity
4.7
First published (updated )
CVE-2026-18209

Keycloak keycloak-servicesKeycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

Risk 38
Severity
6.5
First published (updated )
CVE-2026-18208

Keycloak KeycloakKeycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass

Risk 20
Severity
3.7
First published (updated )
CVE-2026-18206

Keycloak KeycloakKeycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes

Risk 38
Severity
6.5
First published (updated )
CVE-2026-18203
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Keycloak KeycloakKeycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Risk 39
Severity
5.5
First published (updated )
CVE-2026-18201

redhat Enterprise LinuxGimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images

Risk 51
Severity
7.1
First published (updated )
CVE-2026-66759

redhat Enterprise LinuxGimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images

Risk 68
Severity
7.8
First published (updated )
CVE-2026-66758

redhat Enterprise LinuxGimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images

Risk 31
Severity
5.5
First published (updated )
CVE-2026-66757

Keycloak keycloak-servicesKeycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

Risk 38
Severity
6.5
First published (updated )
CVE-2026-17059
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Keycloak Keycloak Admin REST APIKeycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

Risk 39
Severity
5.5
First published (updated )
CVE-2026-17048

redhat Build Of KeycloakKeycloak-services: keycloak-services: saml broker metadata import disables response signature validation

Risk 66
Severity
9.1
First published (updated )
CVE-2026-16443

redhat Build Of KeycloakKeycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

Risk 86
Severity
9.8
First published (updated )
CVE-2026-16442

Keycloak Keycloak Admin REST APIKeycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2

Risk 38
Severity
6.5
First published (updated )
CVE-2026-16108

Keycloak KeycloakKeycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

Risk 30
Severity
4.9
First published (updated )
CVE-2026-16106
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203