Red Hat Single Sign-On 7 vulnerabilities | LiveThreat CVE Feed

Product

Red Hat Single Sign-On 7

by Red Hat · last CVE Oct 21, 2026

107

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities107 In the news1 Timeline

Severity mix

Critical 14High 51Medium 35Low 7

Severity

All severities107 Critical14 High51 Medium35 Low7

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Red Hat Single Sign-On 7 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-49875	9.8	1%	Jun 12	Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils Affected: All versions, or not specified
CVE-2026-42581	9.8	1%	May 13	Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization Affected: All versions, or not specified
CVE-2026-33228	9.8	1%	Mar 20	flatted: Prototype Pollution via parse() Affected: All versions, or not specified
CVE-2026-27606	9.8	2%	Feb 25	Rollup 4 has Arbitrary File Write via Path Traversal Affected: All versions, or not specified
CVE-2025-12543	9.6	1%	Jan 7	Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf Affected: All versions, or not specified
CVE-2026-18963	9.1	5%	Aug 18	Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass Affected: All versions, or not specified
CVE-2026-42584	9.1	1%	May 13	Netty: HttpClientCodec response desynchronization Affected: All versions, or not specified
CVE-2026-42579	9.1	1%	May 13	Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) Affected: All versions, or not specified
CVE-2026-2332	9.1	1%	Apr 14	HTTP Request Smuggling via Chunked Extension Quoted-String Parsing Affected: All versions, or not specified
CVE-2026-28369	9.1	1%	Mar 27	Undertow: undertow: request smuggling via malformed http request headers Affected: All versions, or not specified
CVE-2026-28367	9.1	1%	Mar 27	Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Affected: All versions, or not specified
CVE-2026-28368	9.1	1%	Mar 27	Undertow: undertow: request smuggling via inconsistent header parsing Affected: All versions, or not specified
CVE-2026-40478	9.0	1%	Apr 17	Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf Affected: All versions, or not specified
CVE-2026-40477	9.0	1%	Apr 17	Improper restriction of the scope of accessible objects in Thymeleaf expressions Affected: All versions, or not specified