Skip to contentRed Hat Jboss Enterprise Application Platform Expansion Pack vulnerabilities
- spring micrometer, red hat amq broker 7.13.6, amq broker 7.14.1 +19 more +21 moreMicrometer HTTP server instrumentations DoS vulnerabilityCVE-2026-40984Fix available7.5 High
- spring micrometer, red hat amq broker 7.14.1, amq clients +18 more +20 moreMicrometer gRPC server instrumentation DoS vulnerabilityCVE-2026-40983Fix available7.5 High
- red hat multicluster engine for kubernetes, enterprise linux 10, enterprise linux 6 +16 more +18 moreNetworkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backendCVE-2026-10805Fix available6.7 Medium
- vitejs launch-editor, vite, red hat cluster observability operator 1.5.0 +25 more +27 morelaunch-editor vulnerable to command injection via the crafted request on WindowsCVE-2024-52011Public exploitFix available7.5 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +4 more +6 moreApache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)CVE-2026-44417Fix available7.5 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +1 more +3 moreApache CXF: LDAP Injection vulnerability in XKMS LDAP RepositoryCVE-2026-44930Fix available9.8 Critical
- js-cookie javascript cookie, js-cookie, red hat cryostat 4 on rhel 9 +24 more +26 moreJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionCVE-2026-46625Fix available7.5 High
- nlnet labs unbound, red hat data grid 8, enterprise linux 10 +10 more +12 moreLong list of incoming EDNS options degrades performanceCVE-2026-41292Fix available6.6 Medium
- apache camel, red hat openshift serverless, build of apache camel 4 for quarkus 3 +4 more +6 moreApache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringCVE-2026-47323Public exploitFix availableEPSS 19.6%9.8 Critical
- io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 moreopentelemetry-java: Unbounded Memory Allocation in W3C Baggage PropagationCVE-2026-45292Fix available5.3 Medium
- spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 moreSpring Cloud Config has an Authorization Bypass Through User-Controlled KeyCVE-2026-40981Fix available7.5 High
- spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 moreSpring Cloud Config vulnerable to Path TraversalCVE-2026-40982Public exploitFix available9.1 Critical
- apache thrift, red hat ai inference server, build of apache camel 3.33 for quarkus 3.33.2.sp1 +7 more +9 moreApache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternCVE-2026-43868Fix available5.3 Medium
- apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +24 more +26 moreApache Thrift: TSSLTransportFactory.java hostname verificationCVE-2026-43869Fix available7.3 High
- quarkus, red hat cryostat 4 on rhel 9, hawtio hawtio 4.4.0 +16 more +18 moreQuarkus authorization bypass via semicolon path normalization inconsistencyCVE-2026-39852Fix available8.8 High
- apache opennlp, red hat build of apache camel for spring boot 4, data grid 8 +4 more +6 moreApache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistorCVE-2026-40682Fix available9.1 Critical
- apache opennlp, red hat build of apache camel for spring boot 4, data grid 8 +5 more +7 moreApache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderCVE-2026-42027Fix available9.8 Critical
- apache opennlp, red hat data grid 8, fuse 7 +2 more +4 moreApache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReaderCVE-2026-42440Fix available7.5 High
- websockets ws, red hat cryostat 4, cryostat 4 on rhel 9 +47 more +49 morews: Uninitialized memory disclosureCVE-2026-45736Fix available4.4 Medium
- spring boot, vmware spring boot, red hat amq broker 7 +14 more +16 moreSpring Boot's default security filter chain has no authorization rule with Actuator but without HealthCVE-2026-40976Fix available9.1 Critical
- spring boot, vmware spring boot, red hat hawtio hawtio 4.4.0 +14 more +16 moreSpring Boot's random value property source uses a weak PRNG unsuitable for secretsCVE-2026-40975Fix available4.8 Medium
- apache camel, red hat build of apache camel for spring boot 4, fuse 7 +2 more +4 moreApache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV storeCVE-2026-27172Public exploitFix available8.8 High
- apache camel, red hat build of apache camel 4.18.1 for spring boot 3.5.14, fuse 7 +2 more +4 moreApache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code ExecutionCVE-2026-33453Public exploitFix available10.0 Critical
- apache camel, red hat build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +8 more +10 moreApache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)CVE-2026-33454Public exploitFix available9.4 Critical
- apache camel, apache software foundation camel platform http main, red hat openshift serverless +7 more +9 moreApache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtimeCVE-2026-40022Public exploitFix available8.2 High
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation RepositoryCVE-2026-40858Public exploitFix available8.8 High
- apache camel, apache software foundation camel coap, camel google pubsub +10 more +12 moreApache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows ca…CVE-2026-40453Public exploitFix available9.9 Critical
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqpCVE-2026-40860Public exploitFix available9.8 Critical
- simple-git project simple-git, red hat enterprise linux 8, enterprise linux 9 +3 more +5 moresimple-git is vulnerable to Remote Code ExecutionCVE-2026-6951Public exploitFix available9.2 Critical
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by JolokiaCVE-2026-41044Public exploitFix available8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URICVE-2026-40466Fix available8.8 High
- red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33, build of apache camel 4.18.1 for spring boot 3.5.14 +3 more +5 moreCamel-infinispan: camel-infinispan: remote code execution via unsafe deserializationCVE-2026-6857Public exploitFix available7.5 High
- apache httpclient, red hat cryostat 4, migration toolkit for applications 8 +45 more +47 moreApache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verificationCVE-2026-40542Fix available7.3 High
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreervlet Path Not Correctly Included in Path Matching of XML Authorization RulesCVE-2026-22754Fix available7.5 High
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreUnauthorized User Impersonation when Using X.509 Client CertificatesCVE-2026-22747Public exploitFix available6.8 Medium
- apache kafka, red hat openshift serverless, build of apache camel 4 for quarkus 3 +16 more +18 moreApache Kafka: Missing JWT token validation in OAUTHBEARER authenticationCVE-2026-33557Fix available9.1 Critical
- junrar, red hat fuse 7, jboss enterprise application platform 8 +1 more +3 moreJunrar: Path Traversal (Zip-Slip) via Sibling Directory Name PrefixCVE-2026-41245Fix available5.9 Medium
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 moreImproper neutralization of specific syntax patterns for unauthorized expressions in ThymeleafCVE-2026-40478Known exploitedFix available9.1 Critical
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 moreImproper restriction of the scope of accessible objects in Thymeleaf expressionsCVE-2026-40477Known exploitedPublic exploitFix available9.1 Critical
- legion of the bouncy castle inc. bc-java, red hat openshift developer tools and services, openshift developer tools and services 4.12 +30 more +32 moreUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.CVE-2026-3505Fix available8.7 High
- legion of the bouncy castle inc. bc-java, bcpix-lts, bcpkix-fips +43 more +45 morePKIX draft CompositeVerifier accepts empty signature sequence as valid.CVE-2026-5588Fix available6.3 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +29 more +31 moreNon-constant time comparisons risk private key leakage in FrodoKEM.CVE-2026-5598Fix available8.9 High
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +42 more +44 moreLDAP Injection Vulnerability in LDAPStoreHelper.javaCVE-2026-0636Fix available5.5 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +44 more +46 moreGOSTCTR implementation unable to process more than 255 blocks correctlyCVE-2025-14813Fix available9.3 Critical
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +39 more +41 moreHTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-2332Public exploitFix available7.4 High
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- simple-git project simple-git, red hat build of keycloak, enterprise linux 8 +5 more +7 moresimple-git has Command Execution via Option-Parsing BypassCVE-2026-28291Fix available8.1 High
- apache activemq, activemq broker, apache software foundation activemq all +10 more +12 moreApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOMCVE-2026-39304Fix available7.5 High
- eclipse jetty, red hat hawtio hawtio 4.4.0, build of apache camel 4.18.1 for spring boot 3.5.14 +6 more +8 moreDuplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variablesCVE-2026-5795Fix available7.4 High
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +9 more +11 moreVite has a `server.fs.deny` bypass with queriesCVE-2026-393648.2 High
- Show moreLoading…