Read the docs

Red Hat

Records7413All Threatist records
Exploited (KEV)98In CISA KEV
CVSS critical792CVSS 9.0–10.0
CVSS high2681CVSS 7.0–8.9

Exploited now

Red Hat records in CISA KEV
TI-2026-34021 Linux Kernel Missing Initialization of a Variable Vulnerability Priority CRITICAL 93KEV 2026-10-28TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2026-35991 Kludex Starlette HTTP Request/Response Smuggling Vulnerability Priority CRITICAL 86KEV 2026-09-02TI-2015-02874 Red Hat Libuser Race Condition Vulnerability Priority CRITICAL 92KEV 2026-08-26TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04

Components

Products in the NVD configurations · select one to filter the records
Enterprise Linux 1956 records CRITICAL Enterprise Linux Desktop 1928 records CRITICAL Enterprise Linux Server 1891 records CRITICAL Enterprise Linux Workstation 1845 records CRITICAL Enterprise Linux Server Aus 1061 records CRITICAL Enterprise Linux Eus 796 records CRITICAL Enterprise Linux Server Tus 770 records CRITICAL Enterprise Linux Server Eus 622 records CRITICAL

Records

25 records in Data Grid · all components

TI-2015-06239 CVE-2015-7501 · GHSA-fjq5-5j5f-mvxh

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data…

Priority HIGH 84

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Ope…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.85562 Published 2017-11-09 Partial fix · 3.2.2, 4.1 CWE-502
TI-2025-11507 CVE-2025-12543 · GHSA-j382-5jj3-vw4j

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Priority HIGH 76

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01333 Published 2026-01-07 Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
TI-2021-11905 CVE-2021-31917 · GHSA-gwqg-r7f7-jjw4

Improper authentication in Red Hat DataGrid and Infinispan

Priority MEDIUM 45

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01347 Published 2021-09-21 Fixed CWE-287
TI-2020-15661 CVE-2020-25644 · GHSA-hxj4-885f-grgp

Memory leak in wildfly-openssl

Priority LOW 37

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02365 Published 2020-10-06 Partial fix · 1.1.3.Final CWE-401
TI-2020-08666 CVE-2020-10771 · GHSA-84m7-cxq5-q9xc

Cross-site request forgery in Infinispan

Priority LOW 32

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00445 Published 2021-06-02 Fixed CWE-352
TI-2023-04814 CVE-2023-5236 · GHSA-488m-w9fp-5mm2

Infinispan: circular reference on marshalling leads to dos

Priority LOW 31

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01108 Published 2023-12-18 Partial fix · 4.6.2.Final CWE-1047
TI-2020-15726 CVE-2020-25711 · GHSA-8674-26jc-wh98

Missing authorization in infinispan

Priority LOW 31

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.0108 Published 2020-12-03 Fixed in 11.0.6.Final CWE-862
TI-2023-03388 CVE-2023-3629 · GHSA-r4w2-hjmr-36m7

Infinispan: non-admins should not be able to get cache config via rest api

Priority LOW 30

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00721 Published 2023-12-18 Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
TI-2023-03387 CVE-2023-3628 · GHSA-fhr7-8jx4-r9cp

Infispan: rest bulk ops don't check permissions

Priority LOW 30

A flaw was found in Infinispan's REST.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00797 Published 2023-12-18 Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
TI-2021-02587 CVE-2021-3642 · GHSA-5499-qjvh-6j7w

Observable discrepancy in wildfly-elytron

Priority LOW 26

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00846 Published 2021-08-05 Partial fix · 1.10.14, 1.15.5 +1 CWE-203
TI-2019-11043 CVE-2019-14838 · GHSA-82v2-f875-73g9

Improper access control in Red Hat wildfly-core

Priority LOW 25

A flaw was found in wildfly-core before 7.2.5.GA.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01141 Published 2019-10-14 Partial fix · 7.2.5.GA CWE-284
TI-2021-02490 CVE-2021-3536 · GHSA-v2wx-jj66-2hp7

Cross-site scripting in wildfly

Priority LOW 23

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00533 Published 2021-05-20 Partial fix · 23.0.2.Final CWE-79
Open these records in search →