Threat database

A security vulnerability exists in the Keycloak package due to an issue in Bouncy Castle for Java versions before 1. This vulnerability affects Keycloak versions prior to 26.7.5-r3. The flaw has a medium severity rating with a CVSS score of 5.3. A fix is available in Keycloak version 26.7.5-r3.

A medium severity security vulnerability (CVE-2026-97873) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.7.5-r3. The flaw has been fixed in version 26.7.5-r3. No known exploits in the wild have been reported.

A security vulnerability exists in the Keycloak package due to an issue in Bouncy Castle for Java versions before 1. This vulnerability affects Keycloak versions prior to 26.7.5-r3. The flaw has a CVSS 4.0 base score of 6.9, indicating a medium severity. A fix is available in Keycloak version 26.7.5-r3.

A security vulnerability exists in the Keycloak package due to an issue in the Bouncy Castle for Java library versions before 26.7.5-r3. This vulnerability has a medium severity with a CVSS score of 5.9. A fix is available in version 26.7.5-r3.

A high-severity security vulnerability (CVE-2026-71891) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.7.5-r3. The vulnerability has a CVSS 4.0 score of 7.1 and is fixed in version 26.7.5-r3. No known exploits are reported in the wild.

A high-severity security vulnerability (CVE-2026-71889) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.7.5-r3. This vulnerability has a CVSS 4.0 score of 8.7, indicating significant risk. A fix is available in version 26.7.5-r3.

A high-severity security vulnerability (CVE-2026-18036) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.7.5-r3. This vulnerability has a CVSS 4.0 score of 8.2 and impacts confidentiality. A fix is available in version 26.7.5-r3.

A high-severity security vulnerability (CVE-2026-71888) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.7.5-r3. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant risk. A fix is available in version 26.7.5-r3.

CVE-2026-102477 is a security vulnerability in the Keycloak package related to Eclipse Vert. It affects versions prior to 26.7.5-r3 and has a CVSS score of 5.9, indicating a medium severity level. The vulnerability does not impact confidentiality or integrity but causes a high impact on availability. A patch is available in version 26.7.5-r3.

A medium severity security vulnerability (CVE-2026-102460) affects the Keycloak package in Eclipse Vert. The vulnerability impacts availability but does not affect confidentiality or integrity. It is fixed in version 26.7.5-r3.

A high-severity security vulnerability (CVE-2026-118489) affects the Keycloak package in Eclipse Vert. The flaw allows for a network attack with no privileges or user interaction required, resulting in high confidentiality impact but no integrity or availability impact. Fixed versions 26.7.5-r3 and 26.8.1-r2 are available.

A security vulnerability identified as CVE-2026-102467 affects the Keycloak package within Eclipse Vert. The vulnerability impacts versions prior to 26.7.5-r3 and has a CVSS score of 5.9, indicating a medium severity level. The flaw does not affect confidentiality or integrity but impacts availability. A patch is available in version 26.7.5-r3.

A critical security vulnerability in Keycloak affects versions prior to 26.7.5-r3. The issue involves jackson-databind's handling of class-name type IDs, where it validates the outer class but improperly accepts attacker-controlled classes within generic arguments. This can lead to severe impacts on confidentiality, integrity, and availability.

A security vulnerability affects the restic package due to its use of Go JOSE, which implements Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. The vulnerability impacts versions of restic prior to 0.18.1-r13. A fix is available in version 0.18.1-r13. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

A security vulnerability exists in the restic package due to its use of Go JOSE, which implements the Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. The vulnerability affects versions prior to 0.18.1-r13. A fix is available in version 0.18.1-r13. The CVSS 4.0 base score is 6.9, indicating a medium severity issue.

A high-severity security vulnerability affects the restic package through its use of Go JOSE, which implements Javascript Object Signing and Encryption standards. The flaw impacts versions prior to 0.18.1-r13 and can cause denial of service (availability impact) without compromising confidentiality or integrity. A patch is available in version 0.18.1-r13.

CVE-2026-97045 is a medium severity vulnerability in the kedacore-http-add-on affecting versions prior to 0.16.0-r0 and 0.18.1-r13. The issue involves the function childTextNodesAreLiteral, where the logic for walking up the DOM tree incorrectly stopped at the nearest foreign ancestor upon encountering an HTML integration point. This could lead to partial bypass or incorrect processing of HTML content. A fix is available in versions 0.16.0-r0 and 0.18.1-r13.

CVE-2026-78661 is a high-severity vulnerability in the kedacore-http-add-on affecting versions prior to 0.16.0-r0 and 0.18.1-r13. It involves improper handling when coalescing adjacent text nodes in the addText and fosterParent functions, specifically when appending to an existing TextNode's Data via string concatenation. This flaw can lead to a confidentiality impact without affecting integrity or availability. A patch is available in versions 0.16.0-r0 and 0.18.1-r13.

A vulnerability in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to access Beacon policy and targeting information if anonymous web server access is enabled, which is the default configuration.

BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, have an information disclosure vulnerability that allows unauthenticated remote attackers to access .macaroon credential files for an LND node. These credentials can be used to gain full control over the Lightning Network Daemon node, enabling attackers to move funds and steal from affected deployments.