Skip to contentRed Hat Jboss Enterprise Application Platform 7 vulnerabilities
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +2 more +4 morePicketlink-federation: picketlink saml 2.0 auth bypass via missing assertionsCVE-2026-155568.1 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +6 more +8 moreJboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshallerCVE-2026-155558.8 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +5 more +7 moreUndertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgeryCVE-2026-155547.4 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +1 more +3 morePicketlink-federation: auth bypass in picketlink saml unsolicited-responseCVE-2026-105799.8 Critical
- red hat fuse 7, jboss enterprise application platform 7, jboss enterprise application platform 8 +3 more +5 moreWildfly-core: wildfly: arbitrary file read via malicious archive deploymentCVE-2026-243306.5 Medium
- red hat fuse 7, jboss enterprise application platform 7, jboss enterprise application platform 8 +3 more +5 moreWildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.CVE-2026-243294.9 Medium
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8.1, jboss enterprise application platform expansion pack +1 more +3 moreWildfly-core: path traversal on wildfly domain controllerCVE-2026-176144.4 Medium
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8, jboss enterprise application platform 8.1 for rhel 10 +5 more +7 moreJastow: jastow cross-site scripting attack due to unsanitized uriCVE-2025-12799Fix available6.5 Medium
- fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 morejackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513Fix available8.1 High
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +8 more +10 moreApache CXF: JNDI Injection Vulnerability in JMSConfigFactoryCVE-2026-50632Fix available8.1 High
- apache cxf, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +12 more +14 moreApache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtilsCVE-2026-49875Fix available9.8 Critical
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +4 more +6 moreApache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)CVE-2026-44417Fix available7.5 High
- js-cookie javascript cookie, js-cookie, red hat cryostat 4 on rhel 9 +24 more +26 moreJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionCVE-2026-46625Fix available7.5 High
- spring boot, vmware spring boot, red hat amq broker 7 +14 more +16 moreSpring Boot's default security filter chain has no authorization rule with Actuator but without HealthCVE-2026-40976Fix available9.1 Critical
- spring boot, vmware spring boot, red hat hawtio hawtio 4.4.0 +14 more +16 moreSpring Boot's random value property source uses a weak PRNG unsuitable for secretsCVE-2026-40975Fix available4.8 Medium
- apache camel, red hat build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +8 more +10 moreApache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)CVE-2026-33454Public exploitFix available9.4 Critical
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by JolokiaCVE-2026-41044Public exploitFix available8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URICVE-2026-40466Fix available8.8 High
- apache httpclient, red hat cryostat 4, migration toolkit for applications 8 +45 more +47 moreApache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verificationCVE-2026-40542Fix available7.3 High
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreervlet Path Not Correctly Included in Path Matching of XML Authorization RulesCVE-2026-22754Fix available7.5 High
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreUnauthorized User Impersonation when Using X.509 Client CertificatesCVE-2026-22747Public exploitFix available6.8 Medium
- apache kafka, red hat openshift serverless, build of apache camel 4 for quarkus 3 +16 more +18 moreApache Kafka: Missing JWT token validation in OAUTHBEARER authenticationCVE-2026-33557Fix available9.1 Critical
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 moreImproper neutralization of specific syntax patterns for unauthorized expressions in ThymeleafCVE-2026-40478Known exploitedFix available9.1 Critical
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 moreImproper restriction of the scope of accessible objects in Thymeleaf expressionsCVE-2026-40477Known exploitedPublic exploitFix available9.1 Critical
- legion of the bouncy castle inc. bc-java, red hat openshift developer tools and services, openshift developer tools and services 4.12 +30 more +32 moreUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.CVE-2026-3505Fix available8.7 High
- legion of the bouncy castle inc. bc-java, bcpix-lts, bcpkix-fips +43 more +45 morePKIX draft CompositeVerifier accepts empty signature sequence as valid.CVE-2026-5588Fix available6.3 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +29 more +31 moreNon-constant time comparisons risk private key leakage in FrodoKEM.CVE-2026-5598Fix available8.9 High
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +42 more +44 moreLDAP Injection Vulnerability in LDAPStoreHelper.javaCVE-2026-0636Fix available5.5 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +44 more +46 moreGOSTCTR implementation unable to process more than 255 blocks correctlyCVE-2025-14813Fix available9.3 Critical
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +39 more +41 moreHTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-2332Public exploitFix available7.4 High
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- apache activemq, activemq broker, apache software foundation activemq all +10 more +12 moreApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOMCVE-2026-39304Fix available7.5 High
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansCVE-2026-34197In KEVPublic exploitFix availableEPSS 98.3%8.8 High
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800Public exploitFix available8.1 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 moreUndertow: undertow: request smuggling via malformed http request headersCVE-2026-28369Fix available8.7 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +20 more +22 moreUndertow: undertow: request smuggling via `\r\r\r` as a header block terminatorCVE-2026-28367Fix available8.7 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 moreUndertow: undertow: request smuggling via inconsistent header parsingCVE-2026-28368Fix available8.7 High
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926Fix available7.5 High
- codehaus-plexus plexus-utils, red hat cryostat 4, openshift developer tools and services +49 more +51 morePlexus-Utils has a Directory Traversal vulnerability in its extractFile methodCVE-2025-67030Fix available8.8 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Prototype Pollution via parse()CVE-2026-33228Fix available8.9 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Unbounded recursion DoS in parse() revive phaseCVE-2026-32141Fix available7.5 High
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Sensitive information disclosure in client configuration handlingCVE-2026-24308Fix available7.5 High
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManagerCVE-2026-24281Fix available7.4 High
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +35 more +37 moreThe Eclipse Jetty Server Artifact has a Gzip request memory leakCVE-2026-1605Fix available7.5 High
- isaacs node-tar, tar, red hat cryostat 4 +20 more +22 morenode-tar: Hardlink Path Traversal via Drive-Relative LinkpathCVE-2026-29786Public exploitFix available8.2 High
- apache artemis, apache software foundation activemq artemis, red hat amq broker 7.12.6 +17 more +19 moreApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationCVE-2026-27446Fix availableEPSS 11.4%9.3 Critical
- swaldman c3p0, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +15 more +17 morec3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString propertyCVE-2026-27830Fix available8.9 High
- swaldman mchange-commons-java, mchange commons java, red hat build of apache camel - hawtio 4 +17 more +19 moremchange-commons-java: Remote Code Execution via JNDI Reference ResolutionCVE-2026-27727Fix available8.9 High
- ajv.js ajv, red hat confidential compute attestation, cryostat 4 +67 more +69 moreajv has ReDoS when using `$data` optionCVE-2025-69873Fix available2.9 Low
- Show moreLoading…