RH
Product
Red Hat Fuse 7
151
CVEs
0
On KEV
10.0
Max CVSS
3
New 30D
Severity mix
Critical 25High 97Medium 28Low 1
Watch
Add Red Hat Fuse 7 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47691 | 10.0 | Jun 12 | Netty has Insufficient Bailiwick Validation for NS Records Affected: All versions, or not specified |
| CVE-2026-45674 | 10.0 | Jun 12 | Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records Affected: All versions, or not specified |
| CVE-2025-62718 | 9.9 | Apr 9 | Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF Affected: All versions, or not specified |
| CVE-2026-50628 | 9.8 | Jun 12 | Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control Affected: All versions, or not specified |
| CVE-2026-49875 | 9.8 | Jun 12 | Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils Affected: All versions, or not specified |
| CVE-2026-44930 | 9.8 | May 22 | Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository Affected: All versions, or not specified |
| CVE-2026-42581 | 9.8 | May 13 | Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization Affected: All versions, or not specified |
| CVE-2026-42027 | 9.8 | May 4 | Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader Affected: All versions, or not specified |
| CVE-2026-27446 | 9.8 | Mar 4 | Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Affected: All versions, or not specified |
| CVE-2026-27727 | 9.8 | Feb 25 | mchange-commons-java: Remote Code Execution via JNDI Reference Resolution Affected: All versions, or not specified |
| CVE-2026-27606 | 9.8 | Feb 25 | Rollup 4 has Arbitrary File Write via Path Traversal Affected: All versions, or not specified |
| CVE-2026-1615 | 9.8 | Feb 9 | Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions Affected: All versions, or not specified |
| CVE-2025-61140 | 9.8 | Jan 28 | The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution Affected: All versions, or not specified |
| CVE-2025-12543 | 9.6 | Jan 7 | Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf Affected: All versions, or not specified |
| CVE-2026-50627 | 9.1 | Jun 12 | Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator Affected: All versions, or not specified |
| CVE-2026-42584 | 9.1 | May 13 | Netty: HttpClientCodec response desynchronization Affected: All versions, or not specified |
| CVE-2026-42579 | 9.1 | May 13 | Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) Affected: All versions, or not specified |
| CVE-2026-42264 | 9.1 | May 8 | Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking Affected: All versions, or not specified |
| CVE-2026-2332 | 9.1 | Apr 14 | HTTP Request Smuggling via Chunked Extension Quoted-String Parsing Affected: All versions, or not specified |
| CVE-2026-33896 | 9.1 | Mar 27 | Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) Affected: All versions, or not specified |
| CVE-2026-28369 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via malformed http request headers Affected: All versions, or not specified |
| CVE-2026-28367 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Affected: All versions, or not specified |
| CVE-2026-28368 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via inconsistent header parsing Affected: All versions, or not specified |
| CVE-2026-40478 | 9.0 | Apr 17 | Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf Affected: All versions, or not specified |
| CVE-2026-40477 | 9.0 | Apr 17 | Improper restriction of the scope of accessible objects in Thymeleaf expressions Affected: All versions, or not specified |
Showing 25