Priority LOW 38
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00459 · Published 2026-08-05 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551
Priority LOW 38
A flaw was found in Keycloak's Authorization Services.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00459 · Published 2026-08-05 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551
Priority LOW 25
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00393 · Published 2026-07-17 · Partial fix · 26.6.7-3, 26.6-20 CWE-807
Priority LOW 20
A flaw was found in the group search functionality of the Keycloak server's administrative API.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00348 · Published 2026-07-16 · Partial fix · 26.6.7-3, 26.6-20 CWE-639
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1HIGH 7.7· Network · No auth · No interaction · EPSS 0.00854 · Published 2026-06-11 · Partial fix · 1.15.2, 0.31.1 CWE-1321
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00689 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00719 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 43
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00732 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority HIGH 76
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01333 · Published 2026-01-07 · Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
Priority LOW 24
A flaw was found in Infinispan CLI.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00174 · Published 2025-06-26 · Fixed in 15.2.5 CWE-209
Priority LOW 39
A flaw was found in Wildfly Elytron integration.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00885 · Published 2025-03-04 · Partial fix · 7.3.18-3.GA_redhat_00001.1.el7eap, 27.1.9.Final-redhat-00002 +4 CWE-307
Priority LOW 38
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02644 · Published 2024-08-21 · Partial fix · 2.2.36.Final, 2.3.17.Final +27 CWE-362
Priority LOW 34
A flaw was found in Infinispan.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00543 · Published 2023-12-18 · Fixed in 15.0.0.Dev07, 14.0.25.Final CWE-312
Priority LOW 31
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01108 · Published 2023-12-18 · Partial fix · 4.6.2.Final CWE-1047
Priority LOW 30
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00721 · Published 2023-12-18 · Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
Priority LOW 30
A flaw was found in Infinispan's REST.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00797 · Published 2023-12-18 · Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
Priority LOW 33
A vulnerability was found in the Hot Rod client.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00548 · Published 2023-10-04 · Fixed CWE-20
Priority MEDIUM 45
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01347 · Published 2021-09-21 · Fixed CWE-287
Priority LOW 26
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled.
CVSS 3.1MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00846 · Published 2021-08-05 · Partial fix · 1.10.14, 1.15.5 +1 CWE-203
Priority LOW 32
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00445 · Published 2021-06-02 · Fixed CWE-352
Priority LOW 23
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00533 · Published 2021-05-20 · Partial fix · 23.0.2.Final CWE-79
Priority LOW 31
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.0108 · Published 2020-12-03 · Fixed in 11.0.6.Final CWE-862
Priority LOW 37
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02365 · Published 2020-10-06 · Partial fix · 1.1.3.Final CWE-401
Priority LOW 25
A flaw was found in wildfly-core before 7.2.5.GA.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01141 · Published 2019-10-14 · Partial fix · 7.2.5.GA CWE-284
Priority HIGH 84
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Ope…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.85562 · Published 2017-11-09 · Partial fix · 3.2.2, 4.1 CWE-502
THREATIST.IORead the docs