JE
Product
Jboss Enterprise Application Platform Expansion Pack
23
CVEs
0
On KEV
9.6
Max CVSS
0
New 30D
Severity mix
Critical 4High 11Medium 6Low 2
Watch
Add Jboss Enterprise Application Platform Expansion Pack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-12543 | 9.6 | Jan 7 | Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf Affected: All versions, or not specified |
| CVE-2026-28369 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via malformed http request headers Affected: All versions, or not specified |
| CVE-2026-28367 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Affected: All versions, or not specified |
| CVE-2026-28368 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via inconsistent header parsing Affected: All versions, or not specified |
| CVE-2026-18967 | 8.1 | Aug 6 | Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow Affected: All versions, or not specified |
| CVE-2026-16102 | 8.1 | Aug 5 | Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers Affected: All versions, or not specified |
| CVE-2026-15573 | 8.1 | Aug 5 | Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher Affected: All versions, or not specified |
| CVE-2026-41731 | 8.1 | Jun 9 | In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization Affected: All versions, or not specified |
| CVE-2026-3009 | 8.1 | Mar 5 | Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass) Affected: All versions, or not specified |
| CVE-2025-9784 | 7.5 | Sep 2 | Undertow: undertow madeyoureset http/2 ddos vulnerability Affected: All versions, or not specified |
| CVE-2023-4503 | 7.5 | Feb 6 | An improper initialization vulnerability was found in Galleon Affected: All versions, or not specified |
| CVE-2023-1108 | 7.5 | Sep 14 | A flaw was found in undertow Affected: All versions, or not specified |
| CVE-2022-1278 | 7.5 | Sep 13 | A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain Affected: All versions, or not specified |
| CVE-2022-0853 | 7.5 | Mar 11 | A flaw was found in JBoss-client Affected: All versions, or not specified |
| CVE-2026-3121 | 7.2 | Mar 26 | Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission Affected: All versions, or not specified |
| CVE-2026-4366 | 5.8 | Mar 18 | Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak Affected: All versions, or not specified |
| CVE-2025-5731 | 5.5 | Jun 26 | A flaw was found in Infinispan CLI Affected: All versions, or not specified |
| CVE-2026-16093 | 5.4 | Jul 17 | Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers Affected: All versions, or not specified |
| CVE-2021-3642 | 5.3 | Aug 5 | A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if… Affected: All versions, or not specified |
| CVE-2026-14209 | 4.3 | Jun 30 | Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions Affected: All versions, or not specified |
| CVE-2021-20250 | 4.3 | May 13 | A flaw was found in wildfly Affected: All versions, or not specified |
| CVE-2026-4874 | 3.1 | Mar 26 | Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation Affected: All versions, or not specified |
| CVE-2026-15945 | 2.7 | Jul 16 | Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 Affected: All versions, or not specified |
Showing 23