keycloak-26.6

3 results · Clear filters · Feed

• Low 3.7
  CVE-2026-119280

  MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths

  MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_le…

  MariaDB mariadb-connector-j zipkin keycloak-26.6-iamguarded-compat Debian Ubuntu Wolfi Maven
  Oct 29, 2026
• Low 2.7
  CVE-2026-9088

  Keycloak: keycloak: information disclosure due to user profile permission bypass

  A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are e…

  Red Hat Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4.13 Wolfi Maven
  Jun 5, 2026
• Low 2.9
  CVE-2026-42578

  Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  May 13, 2026