Priority LOW 39
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activa…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00925 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-20
Priority LOW 38
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowe…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00697 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-20
Priority MEDIUM 50
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00735 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-20
Priority MEDIUM 48
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.04364 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-289
Priority MEDIUM 43
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00533 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-611
Priority LOW 38
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0051 · Published 2026-06-09 · Partial fix · 4.0.5.1, 3.3.15.1 +5 CWE-502
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00689 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00719 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 43
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00732 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority LOW 30
A container privilege escalation flaw was found in certain Fuse images.
CVSS 3.1MEDIUM 6.4· Local · High privileges · No interaction · EPSS 0.0022 · Published 2026-03-13 · Will not fix CWE-276
Priority HIGH 76
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01333 · Published 2026-01-07 · Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
Priority MEDIUM 43
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02325 · Published 2025-09-02 · Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770
Priority MEDIUM 40
A vulnerability was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04572 · Published 2024-02-19 · Partial fix · 1.5.5.016-1.redhat_00001.1.ep7.el7, 1:1.5.5.016-1.redhat_00001.1.ep7.el7 +24 CWE-400
Priority LOW 36
A flaw was found in undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01771 · Published 2023-09-14 · Partial fix · 2.3.5, 2.2.24 +18 CWE-835
Priority LOW 30
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00335 · Published 2022-08-24 · Partial fix · 5.0.3, 5.1.2 +5 CWE-502
Priority LOW 36
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01774 · Published 2022-08-23 · Partial fix · 2.0.40, 2.2.10 CWE-400
Priority LOW 29
A flaw was found in undertow.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01161 · Published 2022-05-24 · Partial fix · 2.2.9.Final, 2.0.39.Final CWE-362
Priority LOW 30
A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01388 · Published 2021-05-27 · Partial fix · 3.11.1.Final, 4.5.3.Final CWE-79
Priority LOW 32
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01487 · Published 2020-10-30 · Partial fix · 21.0.1 CWE-401
Priority LOW 33
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02126 · Published 2020-07-06 · Partial fix · 5.3.18, 5.4.18 +1 CWE-89
Priority LOW 31
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01002 · Published 2020-05-26 · Partial fix · 2.1.1.Final CWE-444
Priority MEDIUM 44
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03089 · Published 2019-11-25 · Partial fix · 8.2.12.Final, 9.4.17.Final CWE-470
Priority LOW 31
A vulnerability was found in Hibernate-Validator.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02157 · Published 2019-11-08 · Partial fix · 6.0.18.Final, 6.1.0.Final +1 CWE-79
Priority LOW 31
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01165 · Published 2019-11-08 · Fixed CWE-942
Priority LOW 39
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.09712 · Published 2019-05-23 · Partial fix · 3.4.14, 3.5.5 CWE-862
Load more
THREATIST.IORead the docs