# Red Hat JBoss Enterprise Application Platform Expansion Pack.

Every CVE that names Red Hat JBoss Enterprise Application Platform Expansion Pack among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim](https://agentprime.io/advisories/CVE-2026-18208.md)
  `CVE-2026-18208` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints](https://agentprime.io/advisories/CVE-2026-16105.md)
  `CVE-2026-16105` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant](https://agentprime.io/advisories/CVE-2026-18215.md)
  `CVE-2026-18215` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Authentication bypass
- [Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution](https://agentprime.io/advisories/CVE-2026-18217.md)
  `CVE-2026-18217` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 3.4 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-20
- [Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero](https://agentprime.io/advisories/CVE-2026-18218.md)
  `CVE-2026-18218` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations](https://agentprime.io/advisories/CVE-2026-18201.md)
  `CVE-2026-18201` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching](https://agentprime.io/advisories/CVE-2026-18207.md)
  `CVE-2026-18207` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter](https://agentprime.io/advisories/CVE-2026-17059.md)
  `CVE-2026-17059` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api](https://agentprime.io/advisories/CVE-2026-17048.md)
  `CVE-2026-17048` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Information disclosure
- [Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins](https://agentprime.io/advisories/CVE-2026-16104.md)
  `CVE-2026-16104` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Hard-coded credentials, CWE-212
- [Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption](https://agentprime.io/advisories/CVE-2026-16103.md)
  `CVE-2026-16103` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-305, CWE-841
- [Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles](https://agentprime.io/advisories/CVE-2026-16106.md)
  `CVE-2026-16106` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, CWE-1220
- [Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2](https://agentprime.io/advisories/CVE-2026-16108.md)
  `CVE-2026-16108` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Information disclosure, CWE-1220
- [Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers](https://agentprime.io/advisories/CVE-2026-16093.md)
  `CVE-2026-16093` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-807
- [Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session](https://agentprime.io/advisories/CVE-2026-16089.md)
  `CVE-2026-16089` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Authentication bypass, CWE-472
- [Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation](https://agentprime.io/advisories/CVE-2026-16072.md)
  `CVE-2026-16072` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, Information disclosure
- [Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change](https://agentprime.io/advisories/CVE-2026-15943.md)
  `CVE-2026-15943` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-1288
- [Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2](https://agentprime.io/advisories/CVE-2026-15945.md)
  `CVE-2026-15945` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control
- [Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users](https://agentprime.io/advisories/CVE-2026-1609.md)
  `CVE-2026-1609` · CVE record: Keycloak Keycloak and 2 more · CVSS 8.1 High · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email](https://agentprime.io/advisories/CVE-2026-14781.md)
  `CVE-2026-14781` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 4.8 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: CWE-1288
- [Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource](https://agentprime.io/advisories/CVE-2026-14614.md)
  `CVE-2026-14614` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission](https://agentprime.io/advisories/CVE-2026-14613.md)
  `CVE-2026-14613` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Broken access control, CWE-1220
- [Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions](https://agentprime.io/advisories/CVE-2026-14209.md)
  `CVE-2026-14209` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control
- [Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend](https://agentprime.io/advisories/CVE-2026-10805.md)
  `CVE-2026-10805` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Command injection
- [Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak](https://agentprime.io/advisories/CVE-2026-4366.md)
  `CVE-2026-4366` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.8 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution](https://agentprime.io/advisories/CVE-2025-2251.md)
  `CVE-2025-2251` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 7 Apr 2025 · Tags: Insecure deserialization
- [Wildfly: wildfly vulnerable to cross-site scripting (xss)](https://agentprime.io/advisories/CVE-2024-10234.md)
  `CVE-2024-10234` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7 and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 22 Oct 2024 · Tags: Cross-site scripting (XSS)
- [Eap-galleon: custom provisioning creates unsecured http-invoker](https://agentprime.io/advisories/CVE-2023-4503.md)
  `CVE-2023-4503` · CVE record: Red Hat EAP 7.4.14 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-665
- [Jboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions](https://agentprime.io/advisories/CVE-2012-3427.md)
  `CVE-2012-3427` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 2 Feb 2014 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/technology/red-hat-jboss-enterprise-application-platform-expansion-pack.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=red-hat-jboss-enterprise-application-platform-expansion-pack&cursor=WyIyMDI2LTA3LTMxVDA3OjA4OjI0Ljc2NzAwMFoiLCJDVkUtMjAyNi0xODIxMSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/red-hat-jboss-enterprise-application-platform-expansion-pack/?cursor=WyIyMDI2LTA3LTMxVDA3OjA4OjI0Ljc2NzAwMFoiLCJDVkUtMjAyNi0xODIxMSJd>. Everything for agents: <https://agentprime.io/llms.txt>.