Skip to content
Threat Feed

Vendor

Keycloak

6 briefs RSS
high advisory

Privilege Escalation in Keycloak Dynamic Client Registration

A vulnerability in Keycloak's Dynamic Client Registration component allows authenticated users with an Initial Access Token to forge administrative roles via improper claim validation.

Keycloak privilege-escalation identity-management
1t 1c
medium advisory

Suspicious Command Execution via Linux Web Server

This brief describes how attackers exploit vulnerabilities in web applications to execute suspicious shell commands via web server processes on Linux, enabling persistence, discovery, credential access, and reverse shell establishment, which can lead to full system compromise and data exfiltration.

Apache HTTP Server +45 webserver command-injection web-shell vulnerability-exploitation persistence linux
1r 14t
medium threat

Unusual Child Process Execution from Linux Web Servers

This rule detects unusual child process executions originating from web server processes on Linux systems, which attackers may use to maintain persistence on a compromised system by exploiting web server vulnerabilities.

Jira +20 persistence execution command_and_control initial_access linux webserver
2r 4t
medium threat

Suspicious Command Execution via Web Server on Linux

Identifies suspicious command executions via a web server on Linux systems, which may suggest a vulnerability and remote shell access.

Elastic Defend +43 persistence initial-access vulnerability linux
2r 3t
high advisory

Keycloak Vulnerability Allows Data Confidentiality Breach and Security Policy Bypass

A vulnerability in Keycloak versions prior to 26.2.14, 26.4.10, and 26.5.5 allows an attacker to cause a breach of data confidentiality and bypass the security policy, as tracked by CVE-2026-2092.

Keycloak +2 vulnerability data breach security policy bypass
2r 1t 1c
medium advisory

Keycloak Vulnerability Allows Arbitrary Email Sending

An anonymous, remote attacker can exploit a vulnerability in Keycloak to send arbitrary emails, potentially leading to phishing or social engineering attacks.

Keycloak email vulnerability spoofing
2r 1t