Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 76
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01333 · Published 2026-01-07 · Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
Priority HIGH 75
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.87286 · Published 2019-08-13 · Partial fix CWE-400
Priority HIGH 74
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.82813 · Published 2019-08-13 · Partial fix · 0.0.0-20190813141303-74dc4d7220e7 CWE-400
Priority HIGH 73
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.80599 · Published 2021-12-14 · Partial fix CWE-502
Priority HIGH 70
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.01552 · Published 2024-04-17 · Partial fix · 22.0.10, 24.0.3 +12 CWE-22
Priority HIGH 70
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.93547 · Published 2023-12-18 · Partial fix · 0.40.2, 0.17.0 +2 CWE-354
Priority MEDIUM 60
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code ex…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08111 · Published 2019-07-29 · Partial fix · 2.9.9.2, 2.8.11.4 +1 CWE-1321
Priority MEDIUM 50
Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00691 · Published 2023-07-07 · Fixed in 21.1.2 CWE-81
Priority MEDIUM 46
A flaw was found in keycloak in versions prior to 13.0.0.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.17866 · Published 2021-03-08 · Partial fix · 13.0.0 CWE-287
Priority MEDIUM 46
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01892 · Published 2019-10-02 · Partial fix · 2.0.20 CWE-532
Priority MEDIUM 45
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.07289 · Published 2019-03-17 · Partial fix · 2.7.9.4, 2.8.11.2 +1 CWE-502
Priority MEDIUM 44
A flaw was found in undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02659 · Published 2023-09-27 · Partial fix · 2.2.25-3.SP3_redhat_00001.1.el8eap, 2.2.25-3.SP3_redhat_00001.1.el9eap +6 CWE-789
Priority MEDIUM 44
A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00789 · Published 2023-09-22 · Partial fix · 7.6-20 CWE-276
Priority MEDIUM 44
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03089 · Published 2019-11-25 · Partial fix · 8.2.12.Final, 9.4.17.Final CWE-470
Priority MEDIUM 44
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.
CVSS 3.0HIGH 7.5· Network · No auth · User interaction · EPSS 0.08872 · Published 2019-03-17 · Partial fix · 2.7.9.4, 2.8.11.2 +1 CWE-502
Priority MEDIUM 43
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00533 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-611
Priority MEDIUM 43
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00732 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 43
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02325 · Published 2025-09-02 · Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770
Priority MEDIUM 43
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02604 · Published 2020-05-13 · Partial fix · 11.0.0 CWE-20
Priority MEDIUM 43
A flaw was found in keycloack before version 8.0.0.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01718 · Published 2020-01-07 · Fixed in 8.0.0 CWE-547
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00689 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00719 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 41
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01025 · Published 2023-12-12 · Partial fix · 3.0.1-4.b08_redhat_00005.1.ep7.el7, 5.1.17-3.Final_redhat_00004.1.ep7.el7 +18 CWE-770
Priority MEDIUM 41
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01095 · Published 2020-03-16 · Partial fix CWE-757
Load more
THREATIST.IORead the docs