# Red Hat JBoss Enterprise Application Platform Expansion Pack. Every CVE that names Red Hat JBoss Enterprise Application Platform Expansion Pack among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates](https://agentprime.io/advisories/CVE-2026-96453.md) `CVE-2026-96453` · CVE record: Red Hat Red Hat AMQ Broker 7 and 4 more · CVSS 8.0 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS - [Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer](https://agentprime.io/advisories/CVE-2026-93998.md) `CVE-2026-93998` · CVE record: Red Hat Red Hat AMQ Broker 7 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS - [Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses](https://agentprime.io/advisories/CVE-2026-120971.md) `CVE-2026-120971` · CVE record: Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror](https://agentprime.io/advisories/CVE-2026-119542.md) `CVE-2026-119542` · CVE record: Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service - [Undertow: undertow: chunkreader message length permits chunk-size overflow](https://agentprime.io/advisories/CVE-2026-91920.md) `CVE-2026-91920` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: HTTP request smuggling - [Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding](https://agentprime.io/advisories/CVE-2026-114488.md) `CVE-2026-114488` · CVE record: Red Hat Red Hat Fuse 7 and 4 more · CVSS 7.4 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-829 - [Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean](https://agentprime.io/advisories/CVE-2026-19610.md) `CVE-2026-19610` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal](https://agentprime.io/advisories/CVE-2026-114370.md) `CVE-2026-114370` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 4 more · CVSS 3.7 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal - [Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role](https://agentprime.io/advisories/CVE-2026-84823.md) `CVE-2026-84823` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal - [Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name](https://agentprime.io/advisories/CVE-2026-85634.md) `CVE-2026-85634` · CVE record: Red Hat Red Hat Fuse 7 and 4 more · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal - [Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)](https://agentprime.io/advisories/CVE-2026-93579.md) `CVE-2026-93579` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests](https://agentprime.io/advisories/CVE-2026-93568.md) `CVE-2026-93568` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-20 - [Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2](https://agentprime.io/advisories/CVE-2026-85511.md) `CVE-2026-85511` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass - [Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority](https://agentprime.io/advisories/CVE-2026-93569.md) `CVE-2026-93569` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 8.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling - [Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority](https://agentprime.io/advisories/CVE-2026-93567.md) `CVE-2026-93567` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-20 - [Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload](https://agentprime.io/advisories/CVE-2026-10832.md) `CVE-2026-10832` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size](https://agentprime.io/advisories/CVE-2026-93492.md) `CVE-2026-93492` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1035 - [Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config](https://agentprime.io/advisories/CVE-2026-89058.md) `CVE-2026-89058` · CVE record: Red Hat and 4 more · CVSS 7.4 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-346, CWE-942 - [Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver](https://agentprime.io/advisories/CVE-2026-81829.md) `CVE-2026-81829` · CVE record: Red Hat Red Hat build of Quarkus 3.27.5.SP2 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts](https://agentprime.io/advisories/CVE-2026-17526.md) `CVE-2026-17526` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state](https://agentprime.io/advisories/CVE-2026-18212.md) `CVE-2026-18212` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [Resteasy-core: resteasy sourceprovider remote unauthenticated file read](https://agentprime.io/advisories/CVE-2026-17615.md) `CVE-2026-17615` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP1 and 4 more · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: XML external entities (XXE) - [Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine](https://agentprime.io/advisories/CVE-2026-12894.md) `CVE-2026-12894` · CVE record: Quarkus quarkus-qute and 4 more · CVSS 8.8 High · Not analysed yet · Published 31 Aug 2026 · Tags: Code injection - [Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite](https://agentprime.io/advisories/CVE-2026-81624.md) `CVE-2026-81624` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: Denial of service - [Undertow-core: undertow: denial of service via websocket permessage-deflate processing](https://agentprime.io/advisories/CVE-2026-5680.md) `CVE-2026-5680` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Denial of service - [Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding](https://agentprime.io/advisories/CVE-2026-19611.md) `CVE-2026-19611` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.4 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-173 - [Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram](https://agentprime.io/advisories/CVE-2026-76166.md) `CVE-2026-76166` · CVE record: Red Hat Red Hat JBoss Web Server 7.0.3 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption - [Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client](https://agentprime.io/advisories/CVE-2026-15571.md) `CVE-2026-15571` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 7.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-341 - [Io.undertow/undertow: undertow: http response header integrity issue due to character truncation](https://agentprime.io/advisories/CVE-2026-19879.md) `CVE-2026-19879` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-681 - [Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap](https://agentprime.io/advisories/CVE-2026-14180.md) `CVE-2026-14180` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: HTTP request smuggling - [Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener](https://agentprime.io/advisories/CVE-2026-15567.md) `CVE-2026-15567` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Denial of service - [Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method](https://agentprime.io/advisories/CVE-2026-15565.md) `CVE-2026-15565` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption - [Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos](https://agentprime.io/advisories/CVE-2026-15563.md) `CVE-2026-15563` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 7.4 High · Not analysed yet · Published 11 Aug 2026 · Tags: Authentication bypass - [Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service](https://agentprime.io/advisories/CVE-2026-15562.md) `CVE-2026-15562` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption - [Undertow-core: oom via missing limits in chunked trailer in eap's undertow](https://agentprime.io/advisories/CVE-2026-15561.md) `CVE-2026-15561` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Denial of service - [Openjdk-orb: unauthed class loading via iiop in eap](https://agentprime.io/advisories/CVE-2026-15560.md) `CVE-2026-15560` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 8.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-829 - [Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions](https://agentprime.io/advisories/CVE-2026-15556.md) `CVE-2026-15556` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 8.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Weak cryptography or TLS - [Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller](https://agentprime.io/advisories/CVE-2026-15555.md) `CVE-2026-15555` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization - [Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery](https://agentprime.io/advisories/CVE-2026-15554.md) `CVE-2026-15554` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 7.4 High · Not analysed yet · Published 11 Aug 2026 · Tags: Weak cryptography or TLS - [Wildfly-core: wildfly: arbitrary file read via malicious archive deployment](https://agentprime.io/advisories/CVE-2026-24330.md) `CVE-2026-24330` · CVE record: Red Hat Red Hat Fuse 7 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Unrestricted file upload - [Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.](https://agentprime.io/advisories/CVE-2026-24329.md) `CVE-2026-24329` · CVE record: Red Hat Red Hat Fuse 7 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Other injection - [Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow](https://agentprime.io/advisories/CVE-2026-18967.md) `CVE-2026-18967` · CVE record: Red Hat Red Hat Build of Keycloak and 2 more · CVSS 6.4 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Authentication bypass - [Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction](https://agentprime.io/advisories/CVE-2026-16442.md) `CVE-2026-16442` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-346 - [Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text](https://agentprime.io/advisories/CVE-2026-16100.md) `CVE-2026-16100` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Denial of service - [Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary](https://agentprime.io/advisories/CVE-2026-16071.md) `CVE-2026-16071` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, Privilege escalation - [Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers](https://agentprime.io/advisories/CVE-2026-16102.md) `CVE-2026-16102` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Broken access control, CWE-551 - [Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher](https://agentprime.io/advisories/CVE-2026-15573.md) `CVE-2026-15573` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-178, CWE-551 - [Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation](https://agentprime.io/advisories/CVE-2026-16443.md) `CVE-2026-16443` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: Weak cryptography or TLS - [Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens](https://agentprime.io/advisories/CVE-2026-18569.md) `CVE-2026-18569` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 3.7 Low · Not analysed yet · Published 4 Aug 2026 · Tags: Weak cryptography or TLS - [Wildfly-core: path traversal on wildfly domain controller](https://agentprime.io/advisories/CVE-2026-17614.md) `CVE-2026-17614` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7 and 3 more · CVSS 4.4 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal - [Keycloak-services: keycloak-services: client access-type policy condition bypass during client update](https://agentprime.io/advisories/CVE-2026-18573.md) `CVE-2026-18573` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes](https://agentprime.io/advisories/CVE-2026-18572.md) `CVE-2026-18572` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation](https://agentprime.io/advisories/CVE-2026-18571.md) `CVE-2026-18571` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed](https://agentprime.io/advisories/CVE-2026-18570.md) `CVE-2026-18570` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check](https://agentprime.io/advisories/CVE-2026-18209.md) `CVE-2026-18209` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 3.4 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-1288 - [Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass](https://agentprime.io/advisories/CVE-2026-18206.md) `CVE-2026-18206` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 3.7 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction](https://agentprime.io/advisories/CVE-2026-18214.md) `CVE-2026-18214` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes](https://agentprime.io/advisories/CVE-2026-18203.md) `CVE-2026-18203` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control - [Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains](https://agentprime.io/advisories/CVE-2026-18211.md) `CVE-2026-18211` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 4.2 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-20 - [Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim](https://agentprime.io/advisories/CVE-2026-18208.md) `CVE-2026-18208` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .