Red hat jboss enterprise application platform expansion pack

This hub aggregates every CVE we track for Red hat jboss enterprise application platform expansion pack, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat jboss enterprise application platform expansion pack.

• CVE-2026-18967Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow6.4Aug 6, 2026
• CVE-2026-16442Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction7.4Aug 5, 2026
• CVE-2026-16100Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text6.5Aug 5, 2026
• CVE-2026-16071Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary5.4Aug 5, 2026
• CVE-2026-16102Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers8.1Aug 5, 2026
• CVE-2026-15573Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher8.1Aug 5, 2026
• CVE-2026-16443Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation7.4Aug 5, 2026
• CVE-2026-18569Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens3.7Aug 4, 2026
• CVE-2026-17614Wildfly-core: path traversal on wildfly domain controller4.4Aug 4, 2026
• CVE-2026-18573Keycloak-services: keycloak-services: client access-type policy condition bypass during client update6.5Aug 2, 2026
• CVE-2026-18572Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes6.5Aug 2, 2026
• CVE-2026-18571Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation6.6Aug 2, 2026
• CVE-2026-18570Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed5.4Aug 2, 2026
• CVE-2026-18209Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check3.4Jul 31, 2026
• CVE-2026-18206Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass3.7Jul 31, 2026