Jboss enterprise application platform expansion pack
This hub aggregates every CVE we track for Jboss enterprise application platform expansion pack, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Operating Systemson-prem
20
CVEs tracked
1
Critical
9
High
0
In CISA KEV
Severity distribution
HIGH9MEDIUM9LOW1CRITICAL1
Monthly trend
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
1
0
7
0
0
2
2
0
2024-092026-08
Latest CVEs
The 15 most recently published vulnerabilities affecting Jboss enterprise application platform expansion pack.
- CVE-2026-16093Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers5.4
- CVE-2026-15945Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v24.3
- CVE-2026-14209Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions4.3
- CVE-2026-41731In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization8.1
- CVE-2026-28367Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator8.7
- CVE-2026-28369Undertow: undertow: request smuggling via malformed http request headers8.7
- CVE-2026-28368Undertow: undertow: request smuggling via inconsistent header parsing8.7
- CVE-2026-3121Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission6.5
- CVE-2026-4874Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation3.1
- CVE-2026-4366Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak5.8
- CVE-2026-3009Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)8.1
- CVE-2025-12543Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf9.6
- CVE-2025-9784Undertow: undertow madeyoureset http/2 ddos vulnerability7.5
- CVE-2025-5731Infinispan: credential leakage in infinispan cli5.5
- CVE-2023-4503Eap-galleon: custom provisioning creates unsecured http-invoker6.8
Product normalization is registry-driven with AI assist and human review. How it works