PA
Product
Process Automation
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 12Medium 5Low 0
Watch
Add Process Automation to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-14892 | 9.8 | Mar 2 | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using… Affected: 7.0 |
| CVE-2025-12543 | 9.6 | Jan 7 | Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf Affected: 7.0 |
| CVE-2026-28369 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via malformed http request headers Affected: 7.0 |
| CVE-2026-28367 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Affected: 7.0 |
| CVE-2026-28368 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via inconsistent header parsing Affected: 7.0 |
| CVE-2022-1415 | 8.8 | Sep 11 | A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data Affected: 7.0 |
| CVE-2019-14841 | 8.8 | Oct 17 | A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header Affected: 7.0 |
| CVE-2020-1714 | 8.8 | May 13 | A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks Affected: 7.0 |
| CVE-2025-9784 | 7.5 | Sep 2 | Undertow: undertow madeyoureset http/2 ddos vulnerability Affected: 7.0 |
| CVE-2024-7885 | 7.5 | Aug 21 | Undertow: improper state management in proxy protocol parsing causes information leakage Affected: 7.0 |
| CVE-2023-1108 | 7.5 | Sep 14 | A flaw was found in undertow Affected: 7.0 |
| CVE-2019-14839 | 7.5 | Apr 1 | It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using some tool like burp… Affected: 7.0 |
| CVE-2022-0853 | 7.5 | Mar 11 | A flaw was found in JBoss-client Affected: 7.0 |
| CVE-2021-4104 | 7.5 | Dec 14 | JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration Affected: 7.0 |
| CVE-2020-10714 | 7.5 | Sep 23 | A flaw was found in WildFly Elytron version 1.11.3.Final and before Affected: 7.0 |
| CVE-2020-1748 | 7.5 | Sep 16 | A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security… Affected: 7.0 |
| CVE-2021-20218 | 7.4 | Mar 16 | A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after Affected: 7.0 |
| CVE-2021-4178 | 6.7 | Aug 24 | A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above Affected: 7.0 |
| CVE-2019-14863 | 6.1 | Jan 2 | There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along… Affected: 7.0 |
| CVE-2019-14862 | 6.1 | Jan 2 | There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with… Affected: 7.0 |
| CVE-2021-3642 | 5.3 | Aug 5 | A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if… Affected: 7.0 |
| CVE-2021-20306 | 4.3 | Jun 1 | A flaw was found in the BPMN editor in version jBPM 7.51.0.Final Affected: 7.0 |
Showing 22