# Red Hat Single Sign-On 7. Every CVE that names Red Hat Single Sign-On 7 among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)](https://agentprime.io/advisories/CVE-2026-93576.md) `CVE-2026-93576` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 3 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Other injection - [Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2](https://agentprime.io/advisories/CVE-2026-85511.md) `CVE-2026-85511` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass - [Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority](https://agentprime.io/advisories/CVE-2026-93569.md) `CVE-2026-93569` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 8.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling - [Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority](https://agentprime.io/advisories/CVE-2026-93567.md) `CVE-2026-93567` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-20 - [Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload](https://agentprime.io/advisories/CVE-2026-10832.md) `CVE-2026-10832` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line](https://agentprime.io/advisories/CVE-2026-93566.md) `CVE-2026-93566` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte](https://agentprime.io/advisories/CVE-2026-93565.md) `CVE-2026-93565` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)](https://agentprime.io/advisories/CVE-2026-93564.md) `CVE-2026-93564` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service](https://agentprime.io/advisories/CVE-2026-93558.md) `CVE-2026-93558` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos](https://agentprime.io/advisories/CVE-2026-93560.md) `CVE-2026-93560` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 3 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size](https://agentprime.io/advisories/CVE-2026-93492.md) `CVE-2026-93492` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue](https://agentprime.io/advisories/CVE-2026-93491.md) `CVE-2026-93491` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams](https://agentprime.io/advisories/CVE-2026-93488.md) `CVE-2026-93488` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos](https://agentprime.io/advisories/CVE-2026-93563.md) `CVE-2026-93563` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 3 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits](https://agentprime.io/advisories/CVE-2026-93572.md) `CVE-2026-93572` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 3 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder](https://agentprime.io/advisories/CVE-2026-93575.md) `CVE-2026-93575` · CVE record: Red Hat Red Hat AMQ Broker 7 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling](https://agentprime.io/advisories/CVE-2026-93561.md) `CVE-2026-93561` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated](https://agentprime.io/advisories/CVE-2026-93494.md) `CVE-2026-93494` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 3 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Keycloak-services: keycloak-services: broker-originated username collision causes account lockout](https://agentprime.io/advisories/CVE-2026-19607.md) `CVE-2026-19607` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts](https://agentprime.io/advisories/CVE-2026-17526.md) `CVE-2026-17526` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching](https://agentprime.io/advisories/CVE-2026-79651.md) `CVE-2026-79651` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments](https://agentprime.io/advisories/CVE-2026-74909.md) `CVE-2026-74909` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state](https://agentprime.io/advisories/CVE-2026-18212.md) `CVE-2026-18212` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking](https://agentprime.io/advisories/CVE-2026-92358.md) `CVE-2026-92358` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get](https://agentprime.io/advisories/CVE-2026-89298.md) `CVE-2026-89298` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure - [Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts](https://agentprime.io/advisories/CVE-2026-88770.md) `CVE-2026-88770` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters](https://agentprime.io/advisories/CVE-2026-19729.md) `CVE-2026-19729` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal - [Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers](https://agentprime.io/advisories/CVE-2026-82968.md) `CVE-2026-82968` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control - [Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite](https://agentprime.io/advisories/CVE-2026-81624.md) `CVE-2026-81624` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: Denial of service - [Undertow-core: undertow: denial of service via websocket permessage-deflate processing](https://agentprime.io/advisories/CVE-2026-5680.md) `CVE-2026-5680` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired](https://agentprime.io/advisories/CVE-2026-79652.md) `CVE-2026-79652` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 5.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control - [Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding](https://agentprime.io/advisories/CVE-2026-19611.md) `CVE-2026-19611` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.4 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-173 - [Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram](https://agentprime.io/advisories/CVE-2026-76166.md) `CVE-2026-76166` · CVE record: Red Hat Red Hat JBoss Web Server 7.0.3 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption - [Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client](https://agentprime.io/advisories/CVE-2026-15571.md) `CVE-2026-15571` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 7.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-341 - [Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies](https://agentprime.io/advisories/CVE-2026-19608.md) `CVE-2026-19608` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [Io.undertow/undertow: undertow: http response header integrity issue due to character truncation](https://agentprime.io/advisories/CVE-2026-19879.md) `CVE-2026-19879` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-681 - [Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap](https://agentprime.io/advisories/CVE-2026-14180.md) `CVE-2026-14180` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: HTTP request smuggling - [Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener](https://agentprime.io/advisories/CVE-2026-15567.md) `CVE-2026-15567` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Denial of service - [Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method](https://agentprime.io/advisories/CVE-2026-15565.md) `CVE-2026-15565` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption - [Wildfly-core: wildfly: arbitrary file read via malicious archive deployment](https://agentprime.io/advisories/CVE-2026-24330.md) `CVE-2026-24330` · CVE record: Red Hat Red Hat Fuse 7 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Unrestricted file upload - [Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.](https://agentprime.io/advisories/CVE-2026-24329.md) `CVE-2026-24329` · CVE record: Red Hat Red Hat Fuse 7 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Other injection - [Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow](https://agentprime.io/advisories/CVE-2026-18967.md) `CVE-2026-18967` · CVE record: Red Hat Red Hat Build of Keycloak and 2 more · CVSS 6.4 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction](https://agentprime.io/advisories/CVE-2026-16442.md) `CVE-2026-16442` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-346 - [Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text](https://agentprime.io/advisories/CVE-2026-16100.md) `CVE-2026-16100` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary](https://agentprime.io/advisories/CVE-2026-16071.md) `CVE-2026-16071` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, Privilege escalation - [Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers](https://agentprime.io/advisories/CVE-2026-16102.md) `CVE-2026-16102` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Broken access control, CWE-551 - [Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher](https://agentprime.io/advisories/CVE-2026-15573.md) `CVE-2026-15573` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-178, CWE-551 - [Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation](https://agentprime.io/advisories/CVE-2026-16443.md) `CVE-2026-16443` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: Weak cryptography or TLS - [Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens](https://agentprime.io/advisories/CVE-2026-18569.md) `CVE-2026-18569` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 3.7 Low · Not analysed yet · Published 4 Aug 2026 · Tags: Weak cryptography or TLS - [Wildfly-core: path traversal on wildfly domain controller](https://agentprime.io/advisories/CVE-2026-17614.md) `CVE-2026-17614` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7 and 3 more · CVSS 4.4 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal - [Keycloak-services: keycloak-services: client access-type policy condition bypass during client update](https://agentprime.io/advisories/CVE-2026-18573.md) `CVE-2026-18573` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes](https://agentprime.io/advisories/CVE-2026-18572.md) `CVE-2026-18572` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation](https://agentprime.io/advisories/CVE-2026-18571.md) `CVE-2026-18571` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed](https://agentprime.io/advisories/CVE-2026-18570.md) `CVE-2026-18570` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check](https://agentprime.io/advisories/CVE-2026-18209.md) `CVE-2026-18209` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 3.4 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-1288 - [Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass](https://agentprime.io/advisories/CVE-2026-18206.md) `CVE-2026-18206` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 3.7 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction](https://agentprime.io/advisories/CVE-2026-18214.md) `CVE-2026-18214` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes](https://agentprime.io/advisories/CVE-2026-18203.md) `CVE-2026-18203` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains](https://agentprime.io/advisories/CVE-2026-18211.md) `CVE-2026-18211` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 4.2 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim](https://agentprime.io/advisories/CVE-2026-18208.md) `CVE-2026-18208` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .