CVE Tools
Track your stack

Fuse

44 CVEs tracked. 3 of them are in CISA KEV.

This hub aggregates every CVE we track for Fuse, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Fuse CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Fuse CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-091
2025-100
2025-110
2025-120
2026-011
2026-020
2026-034
2026-040
2026-050
2026-066
2026-070
2026-080
2026-090
2026-100
2026-110

Severity

How the 44 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical818%
  • High1636%
  • Medium1330%
  • Low716%

Latest CVEs

The 15 most recently published vulnerabilities affecting Fuse.

  1. CVE-2026-50633Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl8.1
  2. CVE-2026-50632Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory8.1
  3. CVE-2026-50628Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control9.8
  4. CVE-2026-50627Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator9.1
  5. CVE-2026-49875Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils9.8
  6. CVE-2026-41731In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization8.1
  7. CVE-2026-28369Undertow: undertow: request smuggling via malformed http request headers8.7
  8. CVE-2026-28367Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator8.7
  9. CVE-2026-28368Undertow: undertow: request smuggling via inconsistent header parsing8.7
  10. CVE-2025-57849Fuse: privilege escalation via excessive /etc/passwd permissions6.4
  11. CVE-2025-12543Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf9.6
  12. CVE-2025-9784Undertow: undertow madeyoureset http/2 ddos vulnerability7.5
  13. CVE-2024-1635Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol7.5
  14. CVE-2023-1108Undertow: infinite loop in sslconduit during close7.5
  15. CVE-2021-4178A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and priv...6.7

Product grouping is registry-driven, with AI assist and human review. How it works