Open Source Keycloak

productDE

cpe:/a:keycloak:keycloak:-

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical11high32medium6low

updated 2026-10-28

vulnerabilities (111)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2022-3782US	critical9.1	5.95% (93rd)	Exploit	no fix	2023-01-13	—
CVE-2026-9086US	—	0.78% (56th)	Exploit	no fix	2026-06-25	—
CVE-2026-9794US	—	0.44% (38th)	Exploit	no fix	2026-05-28	—
CVE-2026-105306US	medium6.5OT elevated	0.22% (13th)	Exploit	no fix	2026-10-05	—
CVE-2023-6134US	medium5.4	1.32% (71st)	—	no fix	2023-12-14	—
CVE-2023-6563US	high7.7	1.24% (69th)	—	no fix	2023-12-14	—
CVE-2023-6927US	medium6.1	1.11% (66th)	—	no fix	2023-12-18	—
CVE-2022-3916US	medium6.8	0.95% (61st)	—	no fix	2023-09-20	—
CVE-2023-6291US	high7.1	0.95% (61st)	—	no fix	2024-01-26	—
CVE-2026-9083US	—	0.78% (56th)	—	no fix	2026-06-25	—
CVE-2023-0105US	medium6.5	0.72% (54th)	—	no fix	2023-01-13	—
CVE-2025-11419US	—	0.72% (54th)	—	no fix	2025-12-23	—
CVE-2025-2559US	—	0.70% (53rd)	—	no fix	2025-03-25	—
CVE-2023-2585US	high8.1	0.69% (53rd)	—	no fix	2023-12-21	—
CVE-2024-10234US	high7.3	0.68% (52nd)	—	no fix	2024-10-22	—
CVE-2026-9800US	—	0.65% (51st)	—	no fix	2026-06-25	—
CVE-2026-53573US	—	0.65% (51st)	—	no fix	2026-07-31	—
CVE-2026-2575US	—	0.65% (51st)	—	no fix	2026-03-18	—
CVE-2026-18571US	high7.2OT elevated	0.55% (46th)	—	no fix	2026-08-02	—
CVE-2023-2422US	high7.1	0.52% (44th)	—	no fix	2023-10-04	—
CVE-2025-9162US	—	0.52% (44th)	—	no fix	2025-08-21	—
CVE-2026-9099US	—	0.49% (42nd)	—	no fix	2026-06-25	—
CVE-2026-0976US	—	0.49% (42nd)	—	no fix	2026-01-15	—
CVE-2026-4629US	—	0.49% (42nd)	—	no fix	2026-06-30	—
CVE-2026-18573US	—OT elevated	0.48% (41st)	—	no fix	2026-08-02	—
CVE-2026-9801US	—	0.48% (41st)	—	no fix	2026-05-28	—
CVE-2025-1391US	—	0.47% (41st)	—	no fix	2025-02-17	—
CVE-2025-13467US	—	0.47% (41st)	—	no fix	2025-11-25	—
CVE-2026-9705US	—	0.46% (40th)	—	no fix	2026-06-25	—
CVE-2026-16104US	medium6.5	0.46% (39th)	—	no fix	2026-07-17	—
CVE-2026-16072US	—	0.43% (37th)	—	no fix	2026-07-17	—
CVE-2023-1664US	medium6.5	0.43% (37th)	—	no fix	2023-05-26	—
CVE-2026-17048US	medium4.9	0.42% (37th)	—	no fix	2026-07-24	—
CVE-2026-16106US	medium4.9OT elevated	0.42% (36th)	—	no fix	2026-07-17	—
CVE-2026-16105US	—OT elevated	0.42% (36th)	—	no fix	2026-07-31	—
CVE-2026-4633US	low3.7	0.42% (36th)	—	no fix	2026-03-23	—
CVE-2026-9803US	—	0.42% (36th)	—	no fix	2026-05-28	—
CVE-2025-10939US	—	0.41% (35th)	—	no fix	2025-10-28	—
CVE-2026-17059US	medium6.5	0.41% (35th)	—	no fix	2026-07-24	—
CVE-2026-18209US	medium4.7	0.41% (35th)	—	no fix	2026-07-31	—
CVE-2026-12388US	—	0.40% (35th)	—	no fix	2026-06-30	—
CVE-2026-18215US	high8.1	0.40% (34th)	—	no fix	2026-07-31	—
CVE-2026-0707US	—	0.40% (34th)	—	no fix	2026-01-08	—
CVE-2026-18214US	high8.1OT elevated	0.40% (34th)	—	no fix	2026-07-31	—
CVE-2026-16093US	—	0.39% (33rd)	—	no fix	2026-07-17	—
CVE-2026-8830US	—	0.39% (33rd)	—	no fix	2026-05-19	—
CVE-2026-96445US	medium6.8	0.39% (33rd)	—	no fix	2026-09-23	—
CVE-2026-18572US	—OT elevated	0.39% (33rd)	—	no fix	2026-08-02	—
CVE-2026-14209US	—	0.39% (32nd)	—	no fix	2026-06-30	—
CVE-2026-18201US	—OT elevated	0.38% (32nd)	—	no fix	2026-07-29	—

showing 50 of 111

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-862Missing Authorization14 CVEs
CWE-639Authorization Bypass Through User-Controlled Key8 CVEs
CWE-284Improper Access Control6 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6 CVEs
CWE-20Improper Input Validation5 CVEs
CWE-287Improper Authentication5 CVEs
CWE-613Insufficient Session Expiration5 CVEs
CWE-1220Insufficient Granularity of Access Control4 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)111 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan