What’s Vulnerable › Products
RedHat Jboss Enterprise Application Platform Expansion Pack vulnerabilities
23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.
Check whether your RedHat Jboss Enterprise Application Platform Expansion Pack version is affected
Latest RedHat Jboss Enterprise Application Platform Expansion Pack vulnerabilities
- CVE-2026-18967 — Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow (CVSS 8.1)
- CVE-2026-16102 — Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers (CVSS 8.1)
- CVE-2026-15573 — Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher (CVSS 8.1)
- CVE-2026-16093 — Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers (CVSS 5.4)
- CVE-2026-15945 — Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 (CVSS 2.7)
- CVE-2026-14209 — Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions (CVSS 4.3)
- CVE-2026-41731 — In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization (CVSS 8.1)
- CVE-2026-28369 — Undertow: undertow: request smuggling via malformed http request headers (CVSS 9.1)
- CVE-2026-28368 — Undertow: undertow: request smuggling via inconsistent header parsing (CVSS 9.1)
- CVE-2026-28367 — Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator (CVSS 9.1)
- CVE-2026-3121 — Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission (CVSS 7.2)
- CVE-2026-4874 — Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation (CVSS 3.1)
- CVE-2026-4366 — Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak (CVSS 5.8)
- CVE-2026-3009 — Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass) (CVSS 8.1)
- CVE-2025-12543 — Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVSS 9.6)
- CVE-2025-9784 — Undertow: undertow madeyoureset http/2 ddos vulnerability (CVSS 7.5)
- CVE-2025-5731 — Infinispan: credential leakage in infinispan cli (CVSS 5.5)
- CVE-2023-4503 — Eap-galleon: custom provisioning creates unsecured http-invoker (CVSS 7.5)
- CVE-2023-1108 — Undertow: infinite loop in sslconduit during close (CVSS 7.5)
- CVE-2022-1278 — (CVSS 7.5)
- CVE-2022-0853 — (CVSS 7.5)
- CVE-2021-3642 — (CVSS 5.3)
- CVE-2021-20250 — (CVSS 4.3)