Red Hat JBoss Enterprise Application Platform Expansion Pack vulnerabilities

Product

Red Hat JBoss Enterprise Application Platform Expansion Pack

by Red Hat · last CVE Sep 18, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Severity mix

Critical 11High 35Medium 17Low 5

Severity

Exploitation

Watch

Add Red Hat JBoss Enterprise Application Platform Expansion Pack to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-2733	3.8	0%	Feb 19	Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol Affected: All versions, or not specified
CVE-2026-0976	3.7	0%	Jan 15	Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths Affected: All versions, or not specified
CVE-2026-4874	3.1	0%	Mar 26	Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation Affected: All versions, or not specified
CVE-2025-69873	2.9	1%	Feb 11	ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled Affected: All versions, or not specified
CVE-2026-15945	2.7	0%	Jul 16	Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 Affected: All versions, or not specified