Red Hat Security AdvisoryRHSA-2026:18054
Red Hat JBoss Enterprise Application Platform 8.1.6 security update
Released 2026-05-18 · Red Hat rating Important · View on Red Hat →
Fixes 14 records
Priority HIGH 74
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downl…
CVSS 4.0HIGH 8.9· Network · High privileges · No interaction · EPSS 0.00977 · Published 2026-02-25 · Partial fix · 0.4.0 CWE-74
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00701 · Published 2026-03-27 · Partial fix · 4.1.132.Final, 4.2.10.Final CWE-444
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00525 · Published 2026-02-26 · Partial fix · 10.2.3, 9.0.7 +6 CWE-1333
Priority MEDIUM 61
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.114 · Published 2026-03-04 · Partial fix · 2.52.0 CWE-306
Priority MEDIUM 48
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00899 · Published 2026-04-15 · Partial fix · 1.80.2, 1.81.1 +1 CWE-385
Priority MEDIUM 46
Netty is an asynchronous, event-driven network application framework.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.01145 · Published 2026-03-27 · Partial fix · 4.1.132.Final, 4.2.10.Final +1 CWE-770
Priority MEDIUM 45
Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00787 · Published 2026-04-15 · Partial fix · 1.80.2, 1.81.1 +1 CWE-400
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00577 · Published 2026-02-20 · Partial fix · 10.2.1, 9.0.6 +6 CWE-1333
Priority MEDIUM 42
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.
CVSS 4.0CRITICAL 9.3· Local · No auth · No interaction · EPSS 0.0032 · Published 2026-04-15 · Partial fix · 1.80.2, 1.81.1 +1 CWE-327
Priority MEDIUM 41
c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances.
CVSS 4.0HIGH 8.9· Adjacent network · Low privileges · No interaction · EPSS 0.00595 · Published 2026-02-26 · Partial fix · 0.12.0 CWE-502
Priority MEDIUM 41
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00689 · Published 2026-03-25 · Partial fix · 4.0.3, 3.6.1 CWE-22
Priority LOW 39
A flaw was found in Wildfly Elytron integration.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00885 · Published 2025-03-04 · Partial fix · 7.3.18-3.GA_redhat_00001.1.el7eap, 27.1.9.Final-redhat-00002 +4 CWE-307
Priority LOW 35
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00777 · Published 2026-04-15 · Partial fix · 1.80.2, 1.81.1 +4 CWE-327
Priority LOW 31
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc.
CVSS 4.0MEDIUM 5.5· Network · No auth · No interaction · EPSS 0.00527 · Published 2026-04-15 · Partial fix · 1.80.2, 1.81.1 +1 CWE-90
THREATIST.IORead the docs