Skip to contentRed Hat Jboss vulnerabilities
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 moreundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionCVE-2026-1526Fix available7.5 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Unbounded recursion DoS in parse() revive phaseCVE-2026-32141Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 9, jboss core services +2 moreMod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injectionCVE-2026-32344.3 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.11 +3 more +5 moreOrg.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest apiCVE-2026-3429Fix available4.2 Medium
- simple-git project simple-git, red hat logging subsystem for red hat openshift, enterprise linux 8 +4 more +6 moresimple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCECVE-2026-28292Fix available9.8 Critical
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Sensitive information disclosure in client configuration handlingCVE-2026-24308Fix available7.5 High
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManagerCVE-2026-24281Fix available7.4 High
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +5 more +7 moreOrg.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)CVE-2026-3009Fix available8.1 High
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +35 more +37 moreThe Eclipse Jetty Server Artifact has a Gzip request memory leakCVE-2026-1605Fix available7.5 High
- isaacs node-tar, tar, red hat cryostat 4 +20 more +22 morenode-tar: Hardlink Path Traversal via Drive-Relative LinkpathCVE-2026-29786Public exploitFix available8.2 High
- svg svgo, red hat cryostat 4, gatekeeper 3 +45 more +47 moreSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074Fix available7.5 High
- apache artemis, apache software foundation activemq artemis, red hat amq broker 7.12.6 +17 more +19 moreApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationCVE-2026-27446Fix availableEPSS 11.4%9.3 Critical
- redhat keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.9 +4 more +6 moreOrg.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administratorsCVE-2026-0871Fix available4.9 Medium
- swaldman c3p0, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +15 more +17 morec3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString propertyCVE-2026-27830Fix available8.9 High
- swaldman mchange-commons-java, mchange commons java, red hat build of apache camel - hawtio 4 +17 more +19 moremchange-commons-java: Remote Code Execution via JNDI Reference ResolutionCVE-2026-27727Fix available8.9 High
- rollup, red hat openshift pipelines, openshift service mesh 3 +26 more +28 moreRollup 4 has Arbitrary File Write via Path TraversalCVE-2026-27606Public exploitFix available8.8 High
- apache camel, apache software foundation camel leveldb, red hat build of apache camel for spring boot 4 +3 more +5 moreApache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDBCVE-2026-25747Public exploitFix available8.8 High
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.10 +3 more +5 moreOrg.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocolCVE-2026-27333.8 Low
- ajv.js ajv, red hat confidential compute attestation, cryostat 4 +67 more +69 moreajv has ReDoS when using `$data` optionCVE-2025-69873Fix available2.9 Low
- apache tomcat, tomcat native, red hat enterprise linux 10 +10 more +12 moreApache Tomcat Native, Apache Tomcat: OCSP revocation bypassCVE-2026-24734Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreLibxml2: memory leak leading to local denial of service in xmllint interactive shellCVE-2026-1757Fix available6.2 Medium
- red hat build of apicurio registry 2, build of quarkus, data grid 8 +7 more +9 moreUndertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacksCVE-2024-4027Fix available7.5 High
- isaacs node-tar, tar, red hat cryostat 4 +27 more +29 morenode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalCVE-2026-24842Fix available8.2 High
- openssl, red hat cost management 4, ai inference server 3.2 +316 more +318 moreStack buffer overflow in CMS (Auth)EnvelopedData parsingCVE-2025-15467Public exploitFix availableEPSS 74.8%8.8 High
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdataCVE-2026-11903.1 Low
- red hat build of quarkus 3.27.2.redhat, jboss enterprise application platform 8, jboss enterprise application platform expansion pack +1 more +3 moreHibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnectCVE-2025-14969Fix available4.3 Medium
- red hat amq broker 7, build of optaplanner 8, data grid 8 +20 more +22 moreOrg.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionCVE-2026-0603Public exploitFix available8.3 High
- cli, red hat confidential compute attestation, cryostat 4 +32 more +34 morenpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityCVE-2026-0775Fix available7.0 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race conditionCVE-2026-10353.1 Low
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.11 +3 more +5 moreOrg.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uriCVE-2026-11805.8 Medium
- isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 morenode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSCVE-2026-23950Fix available8.8 High
- xmlsoft libxml2, ibm aix, vios +11 more +13 moreLibxml2: libxml2: denial of service via crafted xml catalogsCVE-2026-0992Fix available2.9 Low
- xmlsoft libxml2, ibm aix, vios +11 more +13 moreLibxml2: unbounded relaxng include recursion leading to stack overflowCVE-2026-0989Fix available3.7 Low
- xmlsoft libxml2, ibm aix, vios +11 more +13 moreLibxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processingCVE-2026-0990Fix available5.9 Medium
- red hat build of keycloak, build of keycloak 26.4.9, jboss enterprise application platform 8 +1 more +3 moreOrg.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url pathsCVE-2026-09763.7 Low
- elastic kibana, red hat logging subsystem for red hat openshift, jboss enterprise application platform 8 +3 more +5 moreExternal Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini ConnectorCVE-2026-0532Fix available8.6 High
- apache struts, red hat enterprise linux 8, fuse 7 +2 more +4 moreApache Struts, Apache Struts: XXE vulnerability in outdated XWork componentCVE-2025-68493Public exploitFix availableEPSS 50.4%8.1 High
- alibaba fastjson, red hat openshift service mesh 2, build of apache camel for spring boot 4 +5 more +7 moreFASTJSON Includes Functionality from Untrusted Control SphereCVE-2025-70974Fix available10.0 Critical
- @tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 moreReact Router vulnerable to XSS via Open RedirectsCVE-2026-22029Fix available8.0 High
- @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 moreReact Router has Path Traversal in File Session StorageCVE-2025-61686Public exploitFix availableEPSS 17.3%9.1 Critical
- ruby zlib, red hat logging subsystem for red hat openshift, build of openjdk 1.8 +14 more +16 morezlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()CVE-2026-22184Fix availableDisputed4.6 Medium
- pnpm, red hat jboss enterprise application platform 8, jboss enterprise application platform expansion pack +2 morepnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"CVE-2025-69264Fix available8.8 High
- pnpm, red hat jboss enterprise application platform 8, jboss enterprise application platform expansion pack +2 morepnpm Lockfile Integrity Bypass Allows Remote Dynamic DependenciesCVE-2025-69263Fix available7.5 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +33 more +35 moreUndertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrfCVE-2025-12543Fix available9.6 Critical
- red hat openshift serverless, build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +29 more +31 moreUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedCVE-2024-3884Fix available7.5 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.2 for spring boot 3.5.8 +32 more +34 moreUndertow: undertow madeyoureset http/2 ddos vulnerabilityCVE-2025-9784Public exploitFix available7.5 High
- red hat build of keycloak 26, build of keycloak 26.2, jboss enterprise application platform 8 +3 more +5 moreOrg.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)CVE-2025-7784Fix available6.5 Medium
- infinispan, red hat data grid 8.5.4, jboss enterprise application platform 7 +4 more +6 moreInfinispan: credential leakage in infinispan cliCVE-2025-57315.5 Medium
- xmlsoft libxml2, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +34 more +36 moreLibxml2: stack buffer overflow in xmllint interactive shell command handlingCVE-2025-6170Fix available2.5 Low
- Show moreLoading…