Open Source Keycloak

Name: Open Source Keycloak
Brand: Open Source

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

4critical18high8medium5low

updated 2026-10-27

vulnerabilities (134)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-18963US	—	4.68% (92nd)	Exploit	26.7.2	2026-08-18	2 versions
CVE-2024-3656US	—	3.32% (89th)	Exploit	24.0.5	2024-10-09	< 24.0.5
CVE-2024-8698US	—	2.03% (81st)	Exploit	22.0.13	2024-09-19	2 versions
CVE-2026-19607US	—	0.69% (52nd)	Exploit	26.7.4	2026-09-16	< 26.7.4
CVE-2026-1529US	—	0.49% (42nd)	Exploit	26.5.3	2026-02-09	< 26.5.3
CVE-2026-9794US	—	0.44% (38th)	Exploit	26.6.3	2026-05-28	2 versions
CVE-2026-4282US	—	0.43% (37th)	Exploit	26.5.7	2026-04-02	< 26.5.7
CVE-2024-8883US	—	2.11% (82nd)	—	25.0.6	2024-09-19	3 versions
CVE-2024-10270US	—	1.24% (69th)	—	26.0.6	2024-11-25	< 26.0.6
CVE-2026-33871US	high7.5	1.15% (67th)	—	26.6.2	2026-03-27	< 26.6.2
CVE-2026-42578US	high7.5	1.06% (65th)	—	26.6.3	2026-05-13	< 26.6.3
CVE-2026-42579US	critical9.1	1.01% (63rd)	—	26.6.3	2026-05-13	< 26.6.3
CVE-2024-11734US	—	0.95% (61st)	—	26.0.8	2025-01-14	< 26.0.8
CVE-2024-10451US	—OT elevated	0.92% (60th)	—	26.0.6	2024-11-25	< 26.0.6
CVE-2026-7307US	—	0.88% (59th)	—	26.6.2	2026-05-19	< 26.6.2
CVE-2024-7341US	high7.1	0.85% (58th)	—	25.0.5	2024-09-09	< 25.0.5
CVE-2026-74909US	high8.1OT elevated	0.85% (58th)	—	26.7.4	2026-09-16	< 26.7.4
CVE-2026-42584US	critical9.1	0.84% (58th)	—	26.6.3	2026-05-13	< 26.6.3
CVE-2026-7507US	—	0.84% (58th)	—	26.6.2	2026-05-19	< 26.6.2
CVE-2026-79651US	high7.5	0.81% (57th)	—	26.7.4	2026-09-16	< 26.7.4
CVE-2024-4629US	medium6.5	0.79% (56th)	—	24.0.4	2024-09-03	< 24.0.4
CVE-2024-1722US	medium5.3	0.77% (55th)	—	no fix	2024-02-29	≤ 23.0.5
CVE-2024-11736US	—	0.76% (55th)	—	26.0.8	2025-01-14	< 26.0.8
CVE-2023-6841US	—	0.74% (54th)	—	no fix	2024-09-10	≤ 25.0.5
CVE-2024-10492US	—	0.71% (53rd)	—	26.0.6	2024-11-25	< 26.0.6
CVE-2026-18212US	high7.5	0.70% (53rd)	—	26.7.4	2026-09-16	< 26.7.4
CVE-2025-2559US	—	0.70% (53rd)	—	no fix	2025-03-25	≤ vers:unknown/<26.2.2
CVE-2026-33870US	—	0.70% (53rd)	—	26.6.2	2026-03-27	< 26.6.2
CVE-2025-0604US	—	0.68% (52nd)	—	no fix	2025-01-22	≤ 26.1.0
CVE-2026-15572US	—	0.65% (51st)	—	no fix	2026-08-05	4 versions
CVE-2024-5967US	—OT elevated	0.65% (51st)	—	no fix	2024-06-18	≤ 24.0.5
CVE-2026-42581US	critical9.8	0.63% (50th)	—	26.6.3	2026-05-13	< 26.6.3
CVE-2026-4634US	—	0.63% (50th)	—	26.5.7	2026-04-02	< 26.5.7
CVE-2026-17526US	—OT elevated	0.63% (50th)	—	26.7.4	2026-09-16	< 26.7.4
CVE-2025-8419US	—	0.57% (47th)	—	no fix	2025-08-06	≤ 26.3.2
CVE-2026-44248US	high7.5	0.56% (47th)	—	26.6.3	2026-05-13	< 26.6.3
CVE-2026-1609US	high8.1	0.56% (47th)	—	26.5.3	2026-07-16	< 26.5.3
CVE-2026-16100US	—	0.55% (46th)	—	no fix	2026-08-05	4 versions
CVE-2026-0636US	—	0.53% (44th)	—	26.6.2	2026-04-15	< 26.6.2
CVE-2026-7504US	—	0.50% (43rd)	—	26.6.2	2026-05-19	< 26.6.2
CVE-2026-1486US	—	0.50% (43rd)	—	26.5.3	2026-02-09	< 26.5.3
CVE-2026-3047US	—	0.50% (42nd)	—	26.5.5	2026-03-05	< 26.5.5
CVE-2025-49146US	medium5.9	0.49% (42nd)	—	26.3.2	2025-06-11	< 26.3.2
CVE-2026-4629US	—	0.49% (42nd)	—	26.8.0	2026-06-30	< 26.8.0
CVE-2025-14559US	—OT elevated	0.49% (42nd)	—	26.5.6	2026-01-21	3 versions
CVE-2026-3121US	high7.2	0.48% (41st)	—	26.5.6	2026-03-26	< 26.5.6
CVE-2023-0091US	low3.8OT elevated	0.48% (41st)	—	20.0.3	2023-01-13	< 20.0.3
CVE-2026-9801US	—	0.48% (41st)	—	26.7.0	2026-05-28	2 versions
CVE-2025-13467US	—	0.47% (41st)	—	26.4.6	2025-11-25	< 26.4.6
CVE-2025-3501US	—	0.46% (40th)	—	26.2.2	2025-04-29	2 versions

showing 50 of 134

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-284Improper Access Control12 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')8 CVEs
CWE-266Incorrect Privilege Assignment7 CVEs
CWE-639Authorization Bypass Through User-Controlled Key6 CVEs
CWE-287Improper Authentication5 CVEs
CWE-770Allocation of Resources Without Limits or Throttling5 CVEs
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')5 CVEs
CWE-1220Insufficient Granularity of Access Control4 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)133 CVEs
NLNCSC-NL (CSAF)3 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan