Login Request a demo
GL
Product
Glassfish
by Eclipse · last CVE Aug 6, 2026
13
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 6High 1Medium 6Low 0
Severity
All severities13Critical6High1Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Glassfish to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-9408
9.8
0%
Jul 16
In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints
Affected: 6.2.5
CVE-2024-9342
9.8
0%
Jul 16
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts
Affected: 7.0.16
CVE-2023-5763
9.8
1%
Nov 3
In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access…
Affected: 5.0.0 through 6.2.5
CVE-2026-12605
9.6
0%
Aug 6
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is…
Affected: 8.0.0 before 8.0.4
CVE-2026-2587
9.6
1%
May 19
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler
Affected: before 8.0.2
CVE-2026-2586
9.1
1%
May 19
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console
Affected: before 8.0.2
Showing 6