Red hat jboss enterprise application platform 8

This hub aggregates every CVE we track for Red hat jboss enterprise application platform 8, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat jboss enterprise application platform 8.

• CVE-2026-17614Wildfly-core: path traversal on wildfly domain controller4.4Aug 4, 2026
• CVE-2026-1609Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users8.1Jul 16, 2026
• CVE-2025-12799Jastow: jastow cross-site scripting attack due to unsanitized uri6.5Jul 7, 2026
• CVE-2026-6857Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization7.5Apr 22, 2026
• CVE-2026-28367Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator8.7Mar 27, 2026
• CVE-2026-28369Undertow: undertow: request smuggling via malformed http request headers8.7Mar 27, 2026
• CVE-2026-28368Undertow: undertow: request smuggling via inconsistent header parsing8.7Mar 27, 2026
• CVE-2026-3121Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission6.5Mar 26, 2026
• CVE-2026-4874Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation3.1Mar 26, 2026
• CVE-2026-4628Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control4.3Mar 23, 2026
• CVE-2026-4366Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak5.8Mar 18, 2026
• CVE-2026-3429Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api4.2Mar 11, 2026
• CVE-2026-3009Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)8.1Mar 5, 2026
• CVE-2026-0871Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators4.9Feb 27, 2026
• CVE-2026-2733Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol3.8Feb 19, 2026