CVE Tools
Track your stack

Jboss Web Server

62 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Jboss Web Server, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Jboss Web Server CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Jboss Web Server CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-051
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-021
2026-030
2026-047
2026-052
2026-063
2026-070
2026-080
2026-090
2026-100
2026-110

Severity

How the 62 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1118%
  • High3760%
  • Medium1423%

Latest CVEs

The 15 most recently published vulnerabilities affecting Jboss Web Server.

  1. CVE-2026-50628Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control9.8
  2. CVE-2026-50627Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator9.1
  3. CVE-2026-49875Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils9.8
  4. CVE-2026-43512Apache Tomcat: Digest authenticator will authenticate any unknown user9.8
  5. CVE-2026-41293Apache Tomcat: HTTP/2 request headers not validated9.8
  6. CVE-2026-34500Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled6.5
  7. CVE-2026-34487Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token7.5
  8. CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor7.5
  9. CVE-2026-34483Apache Tomcat: Incomplete escaping of JSON access logs7.5
  10. CVE-2026-29145Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled9.1
  11. CVE-2026-32281Inefficient policy validation in crypto/x5097.5
  12. CVE-2026-32283Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls7.5
  13. CVE-2025-66614Apache Tomcat: Client certificate verification bypass due to virtual host mapping7.6
  14. CVE-2025-46701Apache Tomcat: Security constraint bypass for CGI scripts7.3
  15. CVE-2024-46544Apache Tomcat Connectors: mod_jk: local users can view and modify configuration5.9

Product grouping is registry-driven, with AI assist and human review. How it works