| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2024-3727 | Containers/image: digest type does not guarantee valid type | - | - | High | 8.3 | 2024-05-09 14:57:21 | Deep Dive |
| CVE-2023-6544 | Keycloak: authorization bypass | - | - | Medium | 5.4 | 2024-04-25 15:58:47 | Deep Dive |
| CVE-2023-6484 | Keycloak: log injection during webauthn authentication or registration | - | - | Medium | 5.3 | 2024-04-25 15:58:18 | Deep Dive |
| CVE-2024-1249 | Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos | - | - | High | 7.4 | 2024-04-17 13:22:48 | Deep Dive |
| CVE-2024-1132 | Keycloak: path transversal in redirection validation | - | - | High | 8.1 | 2024-04-17 13:21:19 | Deep Dive |
| CVE-2024-1635 | Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol | - | - | High | 7.5 | 2024-02-19 21:23:14 | Deep Dive |
| CVE-2023-6291 | Keycloak: redirect_uri validation bypass | Red Hat | Red Hat build of Keycloak 22 | High | 7.1 | 2024-01-26 14:23:43 | Deep Dive |
| CVE-2023-47140 | IBM CICS Transaction Gateway improper access controls | IBM | CICS Transaction Gateway Containers | Medium | 4.0 | 2024-01-08 02:08:01 | Deep Dive |
| CVE-2023-2585 | Keycloak: client access via device auth request spoof | Red Hat | Red Hat Single Sign-On 7 | Low | 3.5 | 2023-12-21 09:24:17 | Deep Dive |
| CVE-2023-6927 | Keycloak: open redirect via "form_post.jwt" jarm response mode | Red Hat | Red Hat build of Keycloak 22 | Medium | 4.6 | 2023-12-18 22:59:07 | Deep Dive |
| CVE-2023-6134 | Keycloak: reflected xss via wildcard in oidc redirect_uri | Red Hat | Red Hat build of Keycloak 22 | Medium | 4.6 | 2023-12-14 21:42:12 | Deep Dive |
| CVE-2023-6563 | Keycloak: offline session token dos | Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | High | 7.7 | 2023-12-14 18:01:26 | Deep Dive |
| CVE-2023-2422 | Keycloak: oauth client impersonation | Red Hat | Red Hat Single Sign-On 7 | Medium | 5.5 | 2023-10-04 10:59:31 | Deep Dive |
| CVE-2023-4066 | Operator: passwords defined in secrets shown in statefulset yaml | Red Hat | RHEL-8 based Middleware Containers | Medium | 5.5 | 2023-09-27 20:54:42 | Deep Dive |
| CVE-2023-3223 | Undertow: outofmemoryerror due to @multipartconfig handling | Red Hat | Red Hat Fuse 7.12.1 | High | 7.5 | 2023-09-27 13:54:45 | Deep Dive |
| CVE-2023-4065 | Operator: plaintext password in operator log | Red Hat | RHEL-8 based Middleware Containers | Medium | 5.5 | 2023-09-26 13:25:23 | Deep Dive |
| CVE-2022-4039 | Rhsso-container-image: unsecured management interface exposed to adjecent network | Red Hat | RHEL-8 based Middleware Containers | High | 8.0 | 2023-09-22 14:00:40 | Deep Dive |
| CVE-2022-3916 | Keycloak: session takeover with oidc offline refreshtokens | Red Hat | Red Hat Single Sign-On 7 | Medium | 6.8 | 2023-09-20 14:28:52 | Deep Dive |
| CVE-2022-1438 | Keycloak: xss on impersonation under specific circumstances | Red Hat | Red Hat Single Sign-On 7 | Medium | 6.4 | 2023-09-20 13:34:22 | Deep Dive |
| CVE-2023-4853 | Quarkus: http security policy bypass | Red Hat | Openshift Serverless 1 on RHEL 8 | High | 8.1 | 2023-09-20 09:47:32 | Deep Dive |