Red hat jboss enterprise application platform expansion pack

This hub aggregates every CVE we track for Red hat jboss enterprise application platform expansion pack, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat jboss enterprise application platform expansion pack.

• CVE-2026-85511Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth24.2Sep 18, 2026
• CVE-2026-10832Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload5.9Sep 18, 2026
• CVE-2026-89058Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config7.4Sep 18, 2026
• CVE-2026-89059Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)7.5Sep 18, 2026
• CVE-2026-81829Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver5.3Sep 17, 2026
• CVE-2026-17526Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts7.2Sep 16, 2026
• CVE-2026-18212Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state7.5Sep 16, 2026
• CVE-2026-17615Resteasy-core: resteasy sourceprovider remote unauthenticated file read7.5Aug 31, 2026
• CVE-2026-12894Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine8.8Aug 31, 2026
• CVE-2026-81624Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite7.5Aug 31, 2026
• CVE-2026-5680Undertow-core: undertow: denial of service via websocket permessage-deflate processing7.5Aug 27, 2026
• CVE-2026-19611Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding7.4Aug 20, 2026
• CVE-2026-76166Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram4.3Aug 19, 2026
• CVE-2026-15571Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client7.3Aug 18, 2026
• CVE-2026-18963Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass9.1Aug 18, 2026