Red hat jboss enterprise application platform expansion pack

This hub aggregates every CVE we track for Red hat jboss enterprise application platform expansion pack, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat jboss enterprise application platform expansion pack.

• CVE-2026-11986Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak4.9Jun 11, 2026
• CVE-2026-11577Keycloak: keycloak: privilege escalation via partialimport fgap permission bypass7.2Jun 8, 2026
• CVE-2026-10805Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend6.7Jun 4, 2026
• CVE-2026-6857Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization7.5Apr 22, 2026
• CVE-2026-28369Undertow: undertow: request smuggling via malformed http request headers8.7Mar 27, 2026
• CVE-2026-28367Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator8.7Mar 27, 2026
• CVE-2026-28368Undertow: undertow: request smuggling via inconsistent header parsing8.7Mar 27, 2026
• CVE-2026-3121Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission6.5Mar 26, 2026
• CVE-2026-4874Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation3.1Mar 26, 2026
• CVE-2026-3260Undertow: undertow: denial of service due to premature multipart/form-data parsing in get requests5.9Mar 24, 2026
• CVE-2026-4628Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control4.3Mar 23, 2026
• CVE-2026-4366Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak5.8Mar 18, 2026
• CVE-2026-3429Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api4.2Mar 11, 2026
• CVE-2026-3009Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)8.1Mar 5, 2026
• CVE-2026-0871Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators4.9Feb 27, 2026