RH
Product
Red Hat JBoss Enterprise Application Platform 8
41
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 4High 21Medium 13Low 3
Watch
Add Red Hat JBoss Enterprise Application Platform 8 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-85634 | 8.8 | Oct 15 | Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name Affected: All versions, or not specified |
| CVE-2026-86404 | 8.8 | Sep 7 | Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default Affected: All versions, or not specified |
| CVE-2026-15555 | 8.8 | Aug 11 | Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller Affected: All versions, or not specified |
| CVE-2026-54513 | 8.1 | Jun 23 | jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) Affected: All versions, or not specified |
| CVE-2026-50632 | 8.1 | Jun 12 | Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory Affected: All versions, or not specified |
| CVE-2026-93565 | 7.5 | Sep 18 | Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte Affected: All versions, or not specified |
| CVE-2026-93558 | 7.5 | Sep 18 | Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service Affected: All versions, or not specified |
| CVE-2026-93491 | 7.5 | Sep 18 | Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue Affected: All versions, or not specified |
| CVE-2026-93488 | 7.5 | Sep 18 | Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams Affected: All versions, or not specified |
| CVE-2026-89059 | 7.5 | Sep 18 | Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) Affected: All versions, or not specified |
| CVE-2026-17615 | 7.5 | Aug 31 | Resteasy-core: resteasy sourceprovider remote unauthenticated file read Affected: All versions, or not specified |
| CVE-2026-81624 | 7.5 | Aug 31 | Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite Affected: All versions, or not specified |
| CVE-2026-5680 | 7.5 | Aug 27 | Undertow-core: undertow: denial of service via websocket permessage-deflate processing Affected: All versions, or not specified |
| CVE-2026-44417 | 7.5 | May 22 | Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE) Affected: All versions, or not specified |
| CVE-2026-3505 | 7.5 | Apr 15 | Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion. Affected: All versions, or not specified |
| CVE-2026-5588 | 7.5 | Apr 15 | PKIX draft CompositeVerifier accepts empty signature sequence as valid. Affected: All versions, or not specified |
| CVE-2025-14813 | 7.5 | Apr 15 | GOSTCTR implementation unable to process more than 255 blocks correctly Affected: All versions, or not specified |
| CVE-2026-89058 | 7.4 | Sep 18 | Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config Affected: All versions, or not specified |
| CVE-2026-19611 | 7.4 | Aug 20 | Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding Affected: All versions, or not specified |
| CVE-2026-3121 | 7.2 | Mar 26 | Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission Affected: All versions, or not specified |
| CVE-2026-84823 | 7.1 | Oct 15 | Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role Affected: All versions, or not specified |
Showing 21