Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Advisory: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4.25 — RHSA-2026:53806 Clear all filters
TI-2026-13098 CVE-2026-15560 · GHSA-4238-grjh-g4xm

Openjdk-orb: unauthed class loading via iiop in eap

Priority LOW 39

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes fro…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00751 Published 2026-08-11 Fixed in 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-829
TI-2026-13094 CVE-2026-15556 · GHSA-vw9v-mpfh-qwg3

Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions

Priority LOW 37

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00301 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +9 CWE-347
TI-2026-13092 CVE-2026-15554 · GHSA-f478-cwfc-jqh3

Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery

Priority LOW 35

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00482 Published 2026-08-11 Fixed in 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-295
TI-2026-09097 CVE-2026-10579 · GHSA-wcq4-9xxp-5px6

Picketlink-federation: auth bypass in picketlink saml unsolicited-response

Priority MEDIUM 49

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any r…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00425 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +9 CWE-347