Priority LOW 38
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowe…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00697 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-20
Priority MEDIUM 43
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00533 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-611
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00689 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00719 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 43
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00732 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority LOW 34
A flaw was found in Keycloak.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00479 · Published 2026-03-26 · Partial fix · 26.4.11-1, 26.4-14 +1 CWE-266
Priority LOW 15
A flaw was found in Keycloak.
CVSS 3.1LOW 3.1· Network · Low privileges · No interaction · EPSS 0.00353 · Published 2026-03-26 · Partial fix · 26.4.13-1, 26.4-19 +4 CWE-918
Priority LOW 32
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests.
CVSS 3.1MEDIUM 5.8· Network · No auth · No interaction · EPSS 0.00242 · Published 2026-03-18 · Partial fix · 26.4.12-1, 26.4-17 CWE-918
Priority LOW 37
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.0038 · Published 2026-03-05 · Partial fix · 26.4.10-1, 26.4-12 +1 CWE-863
Priority HIGH 76
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01333 · Published 2026-01-07 · Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
Priority MEDIUM 43
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02325 · Published 2025-09-02 · Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770
Priority LOW 24
A flaw was found in Infinispan CLI.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00174 · Published 2025-06-26 · Fixed in 15.2.5 CWE-209
Priority LOW 39
A flaw was found in Wildfly Elytron integration.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00885 · Published 2025-03-04 · Partial fix · 7.3.18-3.GA_redhat_00001.1.el7eap, 27.1.9.Final-redhat-00002 +4 CWE-307
Priority LOW 30
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00769 · Published 2025-01-30 · Partial fix · 27.0.1.Final, 28.0.0.Beta2 +32 CWE-284
Priority LOW 28
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than characte…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00493 · Published 2024-11-07 · Partial fix · 6.2.0.Final CWE-79
Priority LOW 35
A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00676 · Published 2024-10-22 · Partial fix · 35.0.0, 2.16.0-21.redhat_00055.1.el8eap +125 CWE-79
Priority LOW 38
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02644 · Published 2024-08-21 · Partial fix · 2.2.36.Final, 2.3.17.Final +27 CWE-362
Priority LOW 30
A vulnerability was found in jberet-core logging.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00808 · Published 2024-04-25 · Partial fix · 2.2.1, 1.3.9.SP3-redhat-00001 +5 CWE-523
Priority MEDIUM 40
A vulnerability was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04572 · Published 2024-02-19 · Partial fix · 1.5.5.016-1.redhat_00001.1.ep7.el7, 1:1.5.5.016-1.redhat_00001.1.ep7.el7 +24 CWE-400
Priority LOW 34
An improper initialization vulnerability was found in Galleon.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0072 · Published 2024-02-06 · Partial fix · 2.2.28-1.SP1_redhat_00001.1.el8eap, 7.4.14-5.GA_redhat_00002.1.el8eap +4 CWE-665
Priority LOW 35
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01033 · Published 2023-12-27 · Fixed in 2.16.0-15.redhat_00049.1.el8eap, 1.76.0-4.redhat_00001.1.el8eap +43 CWE-789
Priority LOW 30
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00721 · Published 2023-12-18 · Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
Priority LOW 30
A flaw was found in Infinispan's REST.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00797 · Published 2023-12-18 · Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
Priority HIGH 70
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.93547 · Published 2023-12-18 · Partial fix · 0.40.2, 0.17.0 +2 CWE-354
Priority MEDIUM 41
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01025 · Published 2023-12-12 · Partial fix · 3.0.1-4.b08_redhat_00005.1.ep7.el7, 5.1.17-3.Final_redhat_00004.1.ep7.el7 +18 CWE-770
Load more
THREATIST.IORead the docs