OSV - Open Source Vulnerabilities

CLEANSTART-2026-FA60324

CleanStart/keycloak

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session

15 Apr

Fix available
Severity - 9.8 (Critical)

CLEANSTART-2026-KC06018

CleanStart/keycloak

Security fixes for CVE-2017-12158, CVE-2017-12159, ghsa-3p8m-j85q-pgmj, ghsa-45p5-v273-3qqr, ghsa-4cx2-fc23-5wg6, ghsa-5rfx-cp42-p624, ghsa-72hv-8253-57qq, ghsa-84h7-rjj3-6jx4, ghsa-9342-92gg-6v29, ghsa-cbdj-484d-3x9q, ghsa-fghv-69vj-qj49, ghsa-h5fg-jpgr-rv9c, ghsa-hq9p-pm7w-8p54, ghsa-j288-q9x7-2f5v, ghsa-pwqr-wmgm-9rr8, ghsa-w9fj-cfpg-grvv applied in versions: 26.1.4-r1, 26.5.0-r0, 26.5.0-r1, 26.5.0-r2, 26.5.6-r3

06 Apr

Fix available

MINI-g73j-m8fr-9j3r

MinimOS/keycloak
MinimOS/keycloak-advanced-compat
MinimOS/keycloak-doc

See record for full details

15 Jun 2025

Fix available

BIT-postgresql-jdbc-driver-2025-49146

Bitnami/postgresql-jdbc-driver

pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

14 Jun 2025

Fix available
Severity - 5.9 (Medium)

GHSA-hq9p-pm7w-8p54

Maven/org.postgresql:postgresql

pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

11 Jun 2025

Fix available
Severity - 8.2 (High)

CVE-2025-49146

github.com/pgjdbc/pgjdbc

pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

11 Jun 2025

Fix available
Severity - 8.2 (High)