PA
Vendor
Payara
10
CVEs
0
On KEV
0
New 30D
Products
PA8.4
Payara
Payara
6 CVEs0 on KEV0 new
PS9.8
Payara Server
Payara
3 CVEs0 on KEV0 new
MC7.5
Micro Community
Payara
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-92082 | PS Payara Server Payara | 6.3 | Sep 15 | Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts |
| CVE-2026-12986 | PS Payara Server Payara | 7.3 | Jun 24 | A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin… |
| CVE-2025-1534 | PA Payara Payara | 5.4 | Apr 1 | Cross-site Scripting (Stored) |
| CVE-2024-8215 | PA Payara Payara | 8.4 | Oct 8 | Payload Injection Attack via Management REST interface |
| CVE-2024-7312 | PA Payara Payara | 6.1 | Sep 11 | REST Interface Link Redirection via Host parameter |
| CVE-2023-41699 | PA Payara Payara | 6.1 | Nov 15 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to… |
| CVE-2023-28462 | PS Payara Server Payara | 9.8 | Mar 30 | A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181… |
| CVE-2022-45129 | PA Payara Payara | 7.5 | Nov 10 | Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422 |
| CVE-2022-37422 | PA Payara Payara | 7.5 | Aug 18 | Payara through 5.2022.2 allows directory traversal without authentication |
| CVE-2021-41381 | MC Micro Community Payara | 7.5 | Sep 23 | Payara Micro Community 5.2021.6 and below allows Directory Traversal |