RH
Product
Red Hat Single Sign-On 7
117
CVEs
0
On KEV
9.8
Max CVSS
7
New 30D
Severity mix
Critical 14High 55Medium 40Low 9
Watch
Add Red Hat Single Sign-On 7 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-2733 | 3.8 | Feb 19 | Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol Affected: All versions, or not specified |
| CVE-2024-4028 | 3.8 | Feb 18 | Keycloak-core: stored xss in keycloak when creating a items in admin console Affected: All versions, or not specified |
| CVE-2026-114370 | 3.7 | Oct 21 | Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal Affected: All versions, or not specified |
| CVE-2023-0657 | 3.4 | Nov 17 | Keycloak: impersonation via logout token exchange Affected: All versions, or not specified |
| CVE-2026-4874 | 3.1 | Mar 26 | Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation Affected: All versions, or not specified |
| CVE-2026-1190 | 3.1 | Jan 26 | Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata Affected: All versions, or not specified |
| CVE-2025-69873 | 2.9 | Feb 11 | ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled Affected: All versions, or not specified |
| CVE-2026-15945 | 2.7 | Jul 16 | Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 Affected: All versions, or not specified |
| CVE-2024-10492 | 2.7 | Nov 25 | Keycloak-quarkus-server: keycloak path trasversal Affected: All versions, or not specified |
Showing 9