Media
CVE-2026-7500
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 98
Restablecer filtros
Media
CVE-2026-37980
Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Baja
CVE-2026-37977
Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim
Media
CVE-2026-4325
Keycloak: Replay of action tokens via improper handling of single-use entries
Alta
CVE-2026-4282
Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
Alta
CVE-2026-4634
Keycloak: Application-Level DoS via Scope Processing
Alta
CVE-2026-4636
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
Alta
CVE-2026-3872
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
Media
CVE-2026-3121
Keycloak: manage-clients permission escalates to full realm admin access
Media
CVE-2026-3190
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
Baja
CVE-2026-4874
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation
Baja
CVE-2026-4633
Keycloak's identity-first login flow exposes user information
Media
CVE-2026-4628
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
Media
CVE-2026-2575
Keycloak: Denial of Service due to excessive SAMLRequest decompression
Alta
CVE-2026-2603
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
Media
CVE-2026-3429
Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API
Baja
CVE-2026-3911
Keycloak: Information disclosure of disabled user attributes via administrative endpoint
Alta
CVE-2026-3009
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
Baja
CVE-2025-12150
Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass
Baja
CVE-2026-2733
Keycloak: Missing Check on Disabled Client for Docker Registry Protocol
Media
CVE-2025-14778
Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService
Alta
CVE-2026-1486
Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
Alta
CVE-2026-1529
Keycloak affected by improper invitation token validation
Baja
CVE-2025-13881
Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.