Red Hat KeyCloak

Name: Red Hat KeyCloak
Brand: Red Hat

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

2critical8high11medium1low

updated 2026-10-28

vulnerabilities (22)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-1714US	high8.8	2.60% (85th)	—	no fix	2020-05-13	≤ before 11.0.0
CVE-2017-2582US	medium6.5	2.43% (84th)	—	no fix	2018-07-26	≤ 2.5.1
CVE-2017-2646US	high7.5	1.83% (79th)	—	no fix	2018-07-27	≤ 2.5.5
CVE-2019-14837US	critical9.1OT elevated	1.72% (77th)	—	no fix	2020-01-07	≤ before 8.0.0
CVE-2016-8609US	high8.1	1.68% (77th)	—	no fix	2018-08-01	≤ 2.3.0
CVE-2020-14366US	high7.5	1.38% (72nd)	—	no fix	2020-11-09	≤ before (excluding) 12.0.0
CVE-2020-1731US	critical9.8OT elevated	1.28% (70th)	—	no fix	2020-03-02	≤ all versions of keycloak operator before keycloak operator 8.0.2
CVE-2018-14655US	medium5.4	1.19% (68th)	—	no fix	2018-11-13	≤ 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final
CVE-2018-14657US	high8.1	1.16% (67th)	—	no fix	2018-11-13	≤ 4.2.1.Final, 4.3.0.Final
CVE-2020-1744US	medium5.6	1.13% (66th)	—	no fix	2020-03-24	≤ all keycloak versions prior to 9.0.1
CVE-2018-14658US	medium6.1	1.10% (65th)	—	no fix	2018-11-13	≤ 3.2.1.Final
CVE-2019-3868US	low3.8	1.00% (63rd)	—	no fix	2019-04-24	≤ affects up to 6.0.0 version
CVE-2020-1718US	high8.8	1.00% (63rd)	—	no fix	2020-05-12	≤ All versions before 8.0.0
CVE-2020-1758US	medium5.9	0.93% (60th)	—	no fix	2020-05-15	≤ keycloak versions before 10.0.0
CVE-2020-1724US	medium4.3	0.82% (57th)	—	no fix	2020-05-11	≤ All versions before 9.0.2
CVE-2020-1697US	medium5.4	0.76% (55th)	—	no fix	2020-02-10	≤ All versions before 9.0.0
CVE-2019-10201US	high8.1	0.71% (53rd)	—	no fix	2019-08-14	≤ up to keycloak 6.0.1
CVE-2019-10199US	high8.8	0.50% (42nd)	—	no fix	2019-08-14	≤ up to keycloak 6.0.1
CVE-2020-1698US	medium5.5	0.37% (31st)	—	no fix	2020-05-11	≤ All versions before 9.0.0
CVE-2018-10894US	medium5.4OT elevated	0.35% (29th)	—	no fix	2018-08-01	≤ 3.4.3.Final
CVE-2019-3875US	medium4.8OT elevated	0.29% (21st)	—	no fix	2019-06-12	≤ 6.0.2
CVE-2019-10157US	medium5.5OT elevated	0.21% (11th)	—	no fix	2019-06-12	≤ 4.8.3

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor4 CVEs
CWE-287Improper Authentication4 CVEs
CWE-295Improper Certificate Validation3 CVEs
CWE-345Insufficient Verification of Data Authenticity3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2 CVEs
CWE-201Insertion of Sensitive Information Into Sent Data1 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)22 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan