- How many CVEs does keycloak have?
- keycloak has 207 published CVE records since 2017, including 85 in the last two years.
- How many keycloak CVEs are in CISA KEV?
- None of keycloak's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
- Which keycloak products have the most CVEs?
- The keycloak products with the most published CVEs are keycloak, org.keycloak:keycloak-services, org.keycloak:keycloak-core, org.keycloak:keycloak-parent, org.keycloak:keycloak-quarkus-server.
- What are the most common weakness types in keycloak CVEs?
- keycloak's CVEs most often map to these CWE weakness types: CWE-287 (Improper Authentication), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-20 (Improper Input Validation).
- Are there public exploits for keycloak vulnerabilities?
- Yes — 3 of keycloak's CVEs have a known public exploit.
- How many critical keycloak vulnerabilities are there?
- keycloak has 9 critical and 73 high-severity CVEs.
- What is the average severity of keycloak CVEs?
- The average CVSS base score across keycloak's scored CVEs is 6.3.