Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (13 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-18963 1 Redhat 6 Build Keycloak, Build Of Keycloak, Jboss Enterprise Application Platform Expansion Pack and 3 more 2026-08-21 9.1 Critical
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
CVE-2026-15571 1 Redhat 8 Build Keycloak, Build Of Keycloak, Data Grid 8 and 5 more 2026-08-21 7.3 High
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.
CVE-2026-76166 1 Redhat 7 Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack, Jboss Enterprise Web Server and 4 more 2026-08-21 4.3 Medium
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
CVE-2026-19611 1 Redhat 14 Build Keycloak, Build Of Apache Camel For Quarkus, Build Of Debezium 3 and 11 more 2026-08-21 7.4 High
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
CVE-2026-16102 1 Redhat 10 Build Keycloak, Build Of Keycloak, Data Grid and 7 more 2026-08-11 8.1 High
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.
CVE-2025-9784 1 Redhat 15 Apache Camel Hawtio, Apache Camel Spring Boot, Build Of Apache Camel For Spring Boot and 12 more 2026-01-26 7.5 High
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
CVE-2025-5731 2 Infinispan, Redhat 6 Infinispan, Data Grid, Jboss Data Grid and 3 more 2026-01-08 5.5 Medium
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
CVE-2023-4503 1 Redhat 4 Enterprise Linux, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack and 1 more 2024-11-21 6.8 Medium
An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.
CVE-2023-1108 2 Netapp, Redhat 29 Oncommand Workflow Automation, Build Of Quarkus, Camel Quarkus and 26 more 2024-11-21 7.5 High
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
CVE-2022-1278 1 Redhat 10 Amq, Amq Broker, Amq Online and 7 more 2024-11-21 7.5 High
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
CVE-2022-0853 1 Redhat 6 Descision Manager, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack and 3 more 2024-11-21 7.5 High
A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.
CVE-2021-3642 2 Quarkus, Redhat 18 Quarkus, Build Of Quarkus, Camel Quarkus and 15 more 2024-11-21 5.3 Medium
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.
CVE-2021-20250 1 Redhat 5 Jboss-ejb-client, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack and 2 more 2024-11-21 4.3 Medium
A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.