Redhat Process Automation vulnerabilities

• redhat process automation manager, red hat process automation 7 +1 more Rhpam: privilege escalation via excessive /etc/passwd permissions CVE-2025-58713 6.4 MediumApril 8, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 more Undertow: undertow: request smuggling via malformed http request headers CVE-2026-28369 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +20 more +22 more Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator CVE-2026-28367 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 more Undertow: undertow: request smuggling via inconsistent header parsing CVE-2026-28368 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +33 more +35 more Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVE-2025-12543 Fix available 9.6 CriticalJanuary 7, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.2 for spring boot 3.5.8 +32 more +34 more Undertow: undertow madeyoureset http/2 ddos vulnerability CVE-2025-9784 Public exploitFix available 7.5 HighSeptember 2, 2025
• red hat hawtio 4.0.0 for red hat build of apache camel 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.2 for spring boot +26 more +28 more Undertow: improper state management in proxy protocol parsing causes information leakage CVE-2024-7885 Fix available 7.5 HighAugust 21, 2024
• quarkus, red hat openshift serverless 1 on rhel 8, build of optaplanner 8 +20 more +22 more Quarkus: http security policy bypass CVE-2023-4853 Fix available 8.1 HighSeptember 20, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• redhat undertow, netapp oncommand workflow automation, red hat eap 7.4.10 release +31 more +33 more Undertow: infinite loop in sslconduit during close CVE-2023-1108 Fix available 7.5 HighApril 7, 2023
• redhat drools, red hat build of apache camel for spring boot, build of quarkus +16 more +18 more Drools: unsafe data deserialization in streamutils CVE-2022-1415 Fix available 8.1 HighFebruary 10, 2023
• red hat business-central, redhat decision manager, process automation +2 more A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in... CVE-2019-14841 8.8 HighOctober 17, 2022
• redhat process automation manager A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a... CVE-2022-2457 9.8 CriticalAugust 9, 2022
• redhat process automation manager XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with... CVE-2022-2458 8.2 HighAugust 9, 2022
• redhat a-mq streams, build of quarkus, descision manager +6 more +8 more fabric8 kubernetes-client vulnerable CVE-2021-4178 Public exploitFix available 6.7 MediumJuly 15, 2022
• red hat business-central, redhat descision manager, process automation +2 more It was observed that while login into Business-central console, HTTP request discloses sensitive... CVE-2019-14839 7.5 HighApril 1, 2022
• redhat descision manager, jboss enterprise application platform, jboss enterprise application platform expansion pack +2 more +4 more A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss... CVE-2022-0853 Public exploit 7.5 HighMarch 11, 2022
• apache log4j, apache software foundation log4j 1.x, fedoraproject fedora +44 more +46 more Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVE-2021-4104 Public exploitFix available EPSS 80.6% 7.5 HighDecember 14, 2021
• redhat wildfly elytron, quarkus, redhat build of quarkus +11 more +13 more Observable Discrepancy in Wildfly Elytron CVE-2021-3642 Fix available 5.3 MediumAugust 5, 2021
• redhat jbpm, red hat business-central, redhat descision manager +1 more +3 more A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any... CVE-2021-20306 4.3 MediumJune 1, 2021
• redhat kubernetes-client, a-mq online, build of quarkus +6 more +8 more Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client CVE-2021-20218 Fix available 7.4 HighMarch 16, 2021
• redhat wildfly elytron, netapp oncommand insight, redhat codeready studio +4 more +6 more Session Fixation in WildFly Elytron CVE-2020-10714 Fix available 7.5 HighSeptember 23, 2020
• red hat wildfly, redhat wildfly elytron, decision manager +1 more +3 more Incorrect Authorization in WildFly Elytron CVE-2020-1748 Fix available 7.5 HighSeptember 16, 2020
• keycloak, quarkus, redhat decision manager +4 more +6 more Improper Input Validation in Keycloak CVE-2020-1714 Fix available 7.5 HighMay 13, 2020
• red hat business-central, redhat decision manager, process automation manager +2 more A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where... CVE-2019-14886 4.6 MediumMarch 5, 2020
• fasterxml jackson-databind, apache geode, redhat decision manager +5 more +7 more Polymorphic deserialization of malicious object in jackson-databind CVE-2019-14892 Fix available 7.5 HighMarch 2, 2020
• knockoutjs knockout, oracle business intelligence, goldengate +2 more +4 more XSS in knockout CVE-2019-14862 Fix available 6.1 MediumJanuary 2, 2020
• angularjs, red hat angular:, redhat decision manager +1 more +3 more Cross-Site Scripting via JSONP CVE-2019-14863 Fix available 7.1 HighJune 27, 2019