# Red Hat Data Grid 8. Every CVE that names Red Hat Data Grid 8 among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror](https://agentprime.io/advisories/CVE-2026-119542.md) `CVE-2026-119542` · CVE record: Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service - [Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store](https://agentprime.io/advisories/CVE-2026-92171.md) `CVE-2026-92171` · CVE record: Red Hat Red Hat Data Grid 8 · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-214 - [Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling](https://agentprime.io/advisories/CVE-2026-93562.md) `CVE-2026-93562` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing](https://agentprime.io/advisories/CVE-2026-93574.md) `CVE-2026-93574` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling - [Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)](https://agentprime.io/advisories/CVE-2026-93579.md) `CVE-2026-93579` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling](https://agentprime.io/advisories/CVE-2026-93573.md) `CVE-2026-93573` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling - [Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests](https://agentprime.io/advisories/CVE-2026-93568.md) `CVE-2026-93568` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-20 - [Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2](https://agentprime.io/advisories/CVE-2026-85511.md) `CVE-2026-85511` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass - [Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority](https://agentprime.io/advisories/CVE-2026-93569.md) `CVE-2026-93569` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 8.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling - [Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority](https://agentprime.io/advisories/CVE-2026-93567.md) `CVE-2026-93567` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-20 - [Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload](https://agentprime.io/advisories/CVE-2026-10832.md) `CVE-2026-10832` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line](https://agentprime.io/advisories/CVE-2026-93566.md) `CVE-2026-93566` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte](https://agentprime.io/advisories/CVE-2026-93565.md) `CVE-2026-93565` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service](https://agentprime.io/advisories/CVE-2026-93558.md) `CVE-2026-93558` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size](https://agentprime.io/advisories/CVE-2026-93492.md) `CVE-2026-93492` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue](https://agentprime.io/advisories/CVE-2026-93491.md) `CVE-2026-93491` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams](https://agentprime.io/advisories/CVE-2026-93488.md) `CVE-2026-93488` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts](https://agentprime.io/advisories/CVE-2026-17526.md) `CVE-2026-17526` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state](https://agentprime.io/advisories/CVE-2026-18212.md) `CVE-2026-18212` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [Undertow-core: undertow: denial of service via websocket permessage-deflate processing](https://agentprime.io/advisories/CVE-2026-5680.md) `CVE-2026-5680` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service - [Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding](https://agentprime.io/advisories/CVE-2026-19611.md) `CVE-2026-19611` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.4 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-173 - [Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client](https://agentprime.io/advisories/CVE-2026-15571.md) `CVE-2026-15571` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 7.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-341 - [Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap](https://agentprime.io/advisories/CVE-2026-14180.md) `CVE-2026-14180` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: HTTP request smuggling - [Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method](https://agentprime.io/advisories/CVE-2026-15565.md) `CVE-2026-15565` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption - [Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction](https://agentprime.io/advisories/CVE-2026-16442.md) `CVE-2026-16442` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-346 - [Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text](https://agentprime.io/advisories/CVE-2026-16100.md) `CVE-2026-16100` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary](https://agentprime.io/advisories/CVE-2026-16071.md) `CVE-2026-16071` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, Privilege escalation - [Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers](https://agentprime.io/advisories/CVE-2026-16102.md) `CVE-2026-16102` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Broken access control, CWE-551 - [Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher](https://agentprime.io/advisories/CVE-2026-15573.md) `CVE-2026-15573` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-178, CWE-551 - [Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation](https://agentprime.io/advisories/CVE-2026-16443.md) `CVE-2026-16443` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: Weak cryptography or TLS - [Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens](https://agentprime.io/advisories/CVE-2026-18569.md) `CVE-2026-18569` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 3.7 Low · Not analysed yet · Published 4 Aug 2026 · Tags: Weak cryptography or TLS - [Keycloak-services: keycloak-services: client access-type policy condition bypass during client update](https://agentprime.io/advisories/CVE-2026-18573.md) `CVE-2026-18573` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes](https://agentprime.io/advisories/CVE-2026-18572.md) `CVE-2026-18572` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation](https://agentprime.io/advisories/CVE-2026-18571.md) `CVE-2026-18571` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed](https://agentprime.io/advisories/CVE-2026-18570.md) `CVE-2026-18570` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check](https://agentprime.io/advisories/CVE-2026-18209.md) `CVE-2026-18209` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 3.4 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-1288 - [Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass](https://agentprime.io/advisories/CVE-2026-18206.md) `CVE-2026-18206` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 3.7 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction](https://agentprime.io/advisories/CVE-2026-18214.md) `CVE-2026-18214` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes](https://agentprime.io/advisories/CVE-2026-18203.md) `CVE-2026-18203` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains](https://agentprime.io/advisories/CVE-2026-18211.md) `CVE-2026-18211` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 4.2 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim](https://agentprime.io/advisories/CVE-2026-18208.md) `CVE-2026-18208` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints](https://agentprime.io/advisories/CVE-2026-16105.md) `CVE-2026-16105` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant](https://agentprime.io/advisories/CVE-2026-18215.md) `CVE-2026-18215` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution](https://agentprime.io/advisories/CVE-2026-18217.md) `CVE-2026-18217` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 3.4 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero](https://agentprime.io/advisories/CVE-2026-18218.md) `CVE-2026-18218` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations](https://agentprime.io/advisories/CVE-2026-18201.md) `CVE-2026-18201` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching](https://agentprime.io/advisories/CVE-2026-18207.md) `CVE-2026-18207` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter](https://agentprime.io/advisories/CVE-2026-17059.md) `CVE-2026-17059` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api](https://agentprime.io/advisories/CVE-2026-17048.md) `CVE-2026-17048` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Information disclosure - [Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins](https://agentprime.io/advisories/CVE-2026-16104.md) `CVE-2026-16104` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Hard-coded credentials, CWE-212 - [Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption](https://agentprime.io/advisories/CVE-2026-16103.md) `CVE-2026-16103` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-305, CWE-841 - [Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles](https://agentprime.io/advisories/CVE-2026-16106.md) `CVE-2026-16106` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, CWE-1220 - [Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2](https://agentprime.io/advisories/CVE-2026-16108.md) `CVE-2026-16108` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Information disclosure, CWE-1220 - [Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers](https://agentprime.io/advisories/CVE-2026-16093.md) `CVE-2026-16093` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-807 - [Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session](https://agentprime.io/advisories/CVE-2026-16089.md) `CVE-2026-16089` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Authentication bypass, CWE-472 - [Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation](https://agentprime.io/advisories/CVE-2026-16072.md) `CVE-2026-16072` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, Information disclosure - [Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change](https://agentprime.io/advisories/CVE-2026-15943.md) `CVE-2026-15943` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-1288 - [Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2](https://agentprime.io/advisories/CVE-2026-15945.md) `CVE-2026-15945` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email](https://agentprime.io/advisories/CVE-2026-14781.md) `CVE-2026-14781` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 4.8 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: CWE-1288 - [Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource](https://agentprime.io/advisories/CVE-2026-14614.md) `CVE-2026-14614` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Broken access control Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .