Skip to contentRed Hat Jboss Enterprise Application Platform vulnerabilities
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +5 more +7 moreKeycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2CVE-2026-15945Fix available4.3 Medium
- keycloak, red hat jboss enterprise application platform 8, jboss enterprise application platform expansion pack +1 more +3 moreOrg.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled usersCVE-2026-1609Fix available8.1 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8, jboss enterprise application platform 8.1 for rhel 10 +5 more +7 moreJastow: jastow cross-site scripting attack due to unsanitized uriCVE-2025-12799Fix available6.5 Medium
- red hat build of keycloak, data grid 8, jboss enterprise application platform expansion pack +1 more +3 moreKeycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo emailCVE-2026-147814.8 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.14 +5 more +7 moreKeycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresourceCVE-2026-14614Fix available5.4 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.6 +3 more +5 moreKeycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permissionCVE-2026-14613Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +3 more +5 moreKeycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictionsCVE-2026-142094.3 Medium
- apache software foundation kerby, red hat amq clients, data grid 8 +4 more +6 moreApache Kerby: Kerberos Pre-Authentication BypassCVE-2026-57915Fix available7.3 High
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.4 +3 more +5 moreOrg.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusionCVE-2026-11800Public exploitFix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.4.14 +8 more +10 moreKeycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparisonCVE-2026-9800Fix available8.1 High
- fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 morejackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513Fix available8.1 High
- quarkus, red hat cryostat 4 on rhel 9, openshift serverless +15 more +17 moreAuthentication/Authorization Bypass via Advanced Path Normalization VulnerabilitiesCVE-2026-50559Fix available7.5 High
- websockets ws, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 morews: Memory exhaustion DoS from tiny fragments and data chunksCVE-2026-48779Fix available7.5 High
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +3 more +5 moreApache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImplCVE-2026-50633Fix available8.1 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +8 more +10 moreApache CXF: JNDI Injection Vulnerability in JMSConfigFactoryCVE-2026-50632Fix available8.1 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +5 more +7 moreApache CXF: OAuth2: Inverted IP Binding Check Defeats Security ControlCVE-2026-50628Fix available9.8 Critical
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +5 more +7 moreApache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token ValidatorCVE-2026-50627Fix available9.1 Critical
- apache cxf, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +12 more +14 moreApache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtilsCVE-2026-49875Fix available9.8 Critical
- red hat build of keycloak 26.6, build of keycloak 26.6.5, jboss enterprise application platform expansion pack +1 more +3 moreKeycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloakCVE-2026-11986Fix available4.9 Medium
- spring for apache kafka, vmware spring for apache kafka, red hat fuse 7 +2 more +4 moreIn Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserializationCVE-2026-41731Fix available8.1 High
- spring micrometer, red hat amq broker 7.13.6, amq broker 7.14.1 +19 more +21 moreMicrometer HTTP server instrumentations DoS vulnerabilityCVE-2026-40984Fix available7.5 High
- spring micrometer, red hat amq broker 7.14.1, amq clients +18 more +20 moreMicrometer gRPC server instrumentation DoS vulnerabilityCVE-2026-40983Fix available7.5 High
- red hat multicluster engine for kubernetes, enterprise linux 10, enterprise linux 6 +16 more +18 moreNetworkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backendCVE-2026-10805Fix available6.7 Medium
- vitejs launch-editor, vite, red hat cluster observability operator 1.5.0 +25 more +27 morelaunch-editor vulnerable to command injection via the crafted request on WindowsCVE-2024-52011Public exploitFix available7.5 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +4 more +6 moreApache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)CVE-2026-44417Fix available7.5 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +1 more +3 moreApache CXF: LDAP Injection vulnerability in XKMS LDAP RepositoryCVE-2026-44930Fix available9.8 Critical
- js-cookie javascript cookie, js-cookie, red hat cryostat 4 on rhel 9 +24 more +26 moreJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionCVE-2026-46625Fix available7.5 High
- nlnet labs unbound, red hat data grid 8, enterprise linux 10 +10 more +12 moreLong list of incoming EDNS options degrades performanceCVE-2026-41292Fix available6.6 Medium
- apache camel, red hat openshift serverless, build of apache camel 4 for quarkus 3 +4 more +6 moreApache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringCVE-2026-47323Public exploitFix availableEPSS 19.6%9.8 Critical
- io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 moreopentelemetry-java: Unbounded Memory Allocation in W3C Baggage PropagationCVE-2026-45292Fix available5.3 Medium
- spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 moreSpring Cloud Config has an Authorization Bypass Through User-Controlled KeyCVE-2026-40981Fix available7.5 High
- spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 moreSpring Cloud Config vulnerable to Path TraversalCVE-2026-40982Public exploitFix available9.1 Critical
- apache thrift, red hat ai inference server, build of apache camel 3.33 for quarkus 3.33.2.sp1 +7 more +9 moreApache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternCVE-2026-43868Fix available5.3 Medium
- apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +24 more +26 moreApache Thrift: TSSLTransportFactory.java hostname verificationCVE-2026-43869Fix available7.3 High
- quarkus, red hat cryostat 4 on rhel 9, hawtio hawtio 4.4.0 +16 more +18 moreQuarkus authorization bypass via semicolon path normalization inconsistencyCVE-2026-39852Fix available8.8 High
- apache opennlp, red hat build of apache camel for spring boot 4, data grid 8 +4 more +6 moreApache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistorCVE-2026-40682Fix available9.1 Critical
- apache opennlp, red hat build of apache camel for spring boot 4, data grid 8 +5 more +7 moreApache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderCVE-2026-42027Fix available9.8 Critical
- apache opennlp, red hat data grid 8, fuse 7 +2 more +4 moreApache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReaderCVE-2026-42440Fix available7.5 High
- websockets ws, red hat cryostat 4, cryostat 4 on rhel 9 +47 more +49 morews: Uninitialized memory disclosureCVE-2026-45736Fix available4.4 Medium
- spring boot, vmware spring boot, red hat amq broker 7 +14 more +16 moreSpring Boot's default security filter chain has no authorization rule with Actuator but without HealthCVE-2026-40976Fix available9.1 Critical
- spring boot, vmware spring boot, red hat hawtio hawtio 4.4.0 +14 more +16 moreSpring Boot's random value property source uses a weak PRNG unsuitable for secretsCVE-2026-40975Fix available4.8 Medium
- apache camel, red hat build of apache camel for spring boot 4, fuse 7 +2 more +4 moreApache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV storeCVE-2026-27172Public exploitFix available8.8 High
- apache camel, red hat build of apache camel 4.18.1 for spring boot 3.5.14, fuse 7 +2 more +4 moreApache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code ExecutionCVE-2026-33453Public exploitFix available10.0 Critical
- apache camel, red hat build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +8 more +10 moreApache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)CVE-2026-33454Public exploitFix available9.4 Critical
- apache camel, apache software foundation camel platform http main, red hat openshift serverless +7 more +9 moreApache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtimeCVE-2026-40022Public exploitFix available8.2 High
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation RepositoryCVE-2026-40858Public exploitFix available8.8 High
- apache camel, apache software foundation camel coap, camel google pubsub +10 more +12 moreApache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows ca…CVE-2026-40453Public exploitFix available9.9 Critical
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqpCVE-2026-40860Public exploitFix available9.8 Critical
- simple-git project simple-git, red hat enterprise linux 8, enterprise linux 9 +3 more +5 moresimple-git is vulnerable to Remote Code ExecutionCVE-2026-6951Public exploitFix available9.2 Critical
- Show moreLoading…