Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 185

Export CSV
CVE-2024-1249

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Amq Streams Build Keycloak and 12 more
CVE-2023-5685

Xnio: stackoverflowexception when the chain of notifier states becomes problematically big

A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Redhat
Products
Apache-camel-spring-boot Apache Camel Hawtio Build Keycloak and 9 more
CVE-2024-7885

Undertow: improper state management in proxy protocol parsing causes information leakage

A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Hawtio Apache Camel Spring Boot Build Keycloak and 18 more
CVE-2026-120971

Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses

A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apicurio Registry Build Keycloak Camel Quarkus and 6 more
CVE-2026-119542

Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Build Of Apache Camel For Quarkus Camel Quarkus and 7 more
CVE-2020-8908

Temp directory permission issue in Guava

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Google Netapp Oracle and 2 more
Products
Guava Active Iq Unified Manager Commerce Guided Search and 17 more
CVE-2026-15563

Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Els Jboss Enterprise Application Platform Expansion Pack and 4 more
CVE-2026-15567

Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Fuse Jboss Enterprise Application Platform Jboss Enterprise Application Platform Els and 5 more
CVE-2026-15565

Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Build Of Apache Camel For Spring Boot Camel Spring Boot Data Grid 8 and 10 more
CVE-2026-15561

Undertow-core: oom via missing limits in chunked trailer in eap's undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Els Jboss Enterprise Application Platform Expansion Pack and 1 more
CVE-2026-15556

Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Els Jboss Enterprise Application Platform Expansion Pack and 1 more
CVE-2026-15555

Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Els Jboss Enterprise Application Platform Expansion Pack and 1 more
CVE-2012-3427

Jboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions

A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jbosseapxp
CVE-2026-0976

Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Jboss Enterprise Application Platform Jbosseapxp
CVE-2026-4628

Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control

A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Jboss Enterprise Application Platform and 5 more
CVE-2025-14969

Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect

A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jbosseapxp Openshift Devspaces and 1 more
CVE-2026-12894

Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Quarkus Build Of Apache Camel For Quarkus Build Of Quarkus and 4 more
CVE-2026-9800

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Jbosseapxp and 2 more
CVE-2026-81829

Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apicurio Registry Build Of Apicurio Registry Build Of Quarkus and 6 more
CVE-2026-6857

Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Quarkus Apache Camel Spring Boot Build Of Apache Camel For Quarkus and 7 more