Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled

Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read

Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling

Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

Jastow: jastow cross-site scripting attack due to unsanitized uri

LDAP Injection Vulnerability in LDAPStoreHelper.java

Org.keycloak:keycloak-services: keycloak denial of service

Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

React Router vulnerable to XSS via Open Redirects

Keycloak: xss via assertion consumer service url in saml post-binding flow

Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process

Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

Undertow: learningpushhandler can lead to remote memory dos attacks

Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get

Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

Wildfly-core: path traversal on wildfly domain controller

Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering

Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2