Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Red Hat AMQ Broker 7 Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Published	Severity
`CVE-2026-86404`Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default	Exploitation statusNot known exploited	FixNot confirmed	Published09/07/2026	SeverityHigh
`CVE-2026-84218`Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)	Exploitation statusNot known exploited	FixNot confirmed	Published09/01/2026	SeverityHigh
`CVE-2026-13676`fast-uri vulnerable to host confusion via failed IDN canonicalization	Exploitation statusNot known exploited	FixYes	Published06/29/2026	SeverityHigh
`CVE-2026-54513`jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)	Exploitation statusNot known exploited	FixYes	Published06/23/2026	SeverityHigh
`CVE-2026-9697`undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent	Exploitation statusNot known exploited	FixYes	Published06/17/2026	SeverityHigh
`CVE-2026-6734`undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse	Exploitation statusNot known exploited	FixYes	Published06/17/2026	SeverityHigh
`CVE-2026-12151`undici WebSocket client vulnerable to denial of service via fragment count bypass	Exploitation statusNot known exploited	FixYes	Published06/17/2026	SeverityHigh
`CVE-2026-48779`ws: Memory exhaustion DoS from tiny fragments and data chunks	Exploitation statusPublic exploit	FixYes	Published06/16/2026	SeverityHigh
`CVE-2026-12143`form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)	Exploitation statusPublic exploit	FixYes	Published06/12/2026	SeverityHigh
`CVE-2026-50010`Netty's wrapping plain trust manager silently disables hostname verification	Exploitation statusNot known exploited	FixNot confirmed	Published06/12/2026	SeverityHigh
`CVE-2026-48059`Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion	Exploitation statusNot known exploited	FixNot confirmed	Published06/12/2026	SeverityHigh
`CVE-2026-48043`netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion	Exploitation statusNot known exploited	FixNot confirmed	Published06/12/2026	SeverityHigh
`CVE-2026-45416`Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes	Exploitation statusNot known exploited	FixNot confirmed	Published06/12/2026	SeverityHigh
`CVE-2026-44893`Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length	Exploitation statusNot known exploited	FixNot confirmed	Published06/12/2026	SeverityHigh
`CVE-2026-44249`Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking	Exploitation statusNot known exploited	FixNot confirmed	Published06/11/2026	SeverityHigh
`CVE-2026-44486`Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection	Exploitation statusPublic exploit	FixYes	Published06/11/2026	SeverityHigh
`CVE-2026-44487`Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter	Exploitation statusPublic exploit	FixYes	Published06/11/2026	SeverityHigh
`CVE-2026-44488`Axios: Allocation of Resources Without Limits or Throttling in axios	Exploitation statusPublic exploit	FixYes	Published06/11/2026	SeverityHigh
`CVE-2026-44496`Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection	Exploitation statusPublic exploit	FixYes	Published06/11/2026	SeverityHigh
`CVE-2026-44495`Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge	Exploitation statusPublic exploit	FixYes	Published06/11/2026	SeverityHigh
`CVE-2026-44494`Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`	Exploitation statusPublic exploit	FixYes	Published06/11/2026	SeverityHigh
`CVE-2026-44492`Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)	Exploitation statusPublic exploit	FixYes	Published06/11/2026	SeverityHigh
`CVE-2026-40984`Micrometer HTTP server instrumentations DoS vulnerability	Exploitation statusNot known exploited	FixYes	Published06/09/2026	SeverityHigh
`CVE-2026-40983`Micrometer gRPC server instrumentation DoS vulnerability	Exploitation statusNot known exploited	FixYes	Published06/09/2026	SeverityHigh
`CVE-2024-52011`launch-editor vulnerable to command injection via the crafted request on Windows	Exploitation statusNot known exploited	FixYes	Published06/01/2026	SeverityHigh
`CVE-2026-9277`shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`	Exploitation statusNot known exploited	FixYes	Published05/22/2026	SeverityCritical
`CVE-2026-45736`ws: Uninitialized memory disclosure	Exploitation statusPublic exploit	FixYes	Published05/15/2026	SeverityHigh
`CVE-2026-42587`Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS	Exploitation statusPublic exploit	FixYes	Published05/13/2026	SeverityHigh
`CVE-2026-42584`Netty: HttpClientCodec response desynchronization	Exploitation statusPublic exploit	FixYes	Published05/13/2026	SeverityHigh
`CVE-2026-42578`Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation	Exploitation statusPublic exploit	FixYes	Published05/13/2026	SeverityLow
`CVE-2026-42581`Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization	Exploitation statusPublic exploit	FixYes	Published05/13/2026	SeverityHigh
`CVE-2026-42338`ip-address: XSS in Address6 HTML-emitting methods	Exploitation statusPublic exploit	FixYes	Published05/12/2026	SeverityMedium
`CVE-2026-42264`Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking	Exploitation statusPublic exploit	FixYes	Published05/08/2026	SeverityHigh
`CVE-2026-6322`fast-uri vulnerable to host confusion via percent-encoded authority delimiters	Exploitation statusNot known exploited	FixYes	Published05/05/2026	SeverityHigh
`CVE-2026-42198`pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS	Exploitation statusNot known exploited	FixYes	Published04/29/2026	SeverityHigh
`CVE-2026-40542`Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification	Exploitation statusNot known exploited	FixYes	Published04/22/2026	SeverityHigh
`CVE-2026-5588`PKIX draft CompositeVerifier accepts empty signature sequence as valid.	Exploitation statusNot known exploited	FixYes	Published04/15/2026	SeverityMedium
`CVE-2026-5598`Non-constant time comparisons risk private key leakage in FrodoKEM.	Exploitation statusNot known exploited	FixYes	Published04/15/2026	SeverityHigh
`CVE-2026-0636`LDAP Injection Vulnerability in LDAPStoreHelper.java	Exploitation statusNot known exploited	FixYes	Published04/15/2026	SeverityMedium
`CVE-2025-14813`GOSTCTR implementation unable to process more than 255 blocks correctly	Exploitation statusNot known exploited	FixYes	Published04/15/2026	SeverityCritical
`CVE-2026-2332`HTTP Request Smuggling via Chunked Extension Quoted-String Parsing	Exploitation statusPublic exploit	FixYes	Published04/14/2026	SeverityHigh
`CVE-2026-32283`Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls	Exploitation statusNot known exploited	FixYes	Published04/08/2026	SeverityHigh
`CVE-2026-34197`Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans	Exploitation statusKEV	FixYes	Published04/07/2026	SeverityHigh
`CVE-2026-4926`path-to-regexp vulnerable to Denial of Service via sequential optional groups	Exploitation statusNot known exploited	FixYes	Published03/26/2026	SeverityHigh
`CVE-2025-67030`CVE-2025-67030	Exploitation statusNot known exploited	FixNot confirmed	Published03/25/2026	SeverityHigh
`CVE-2026-33228`flatted: Prototype Pollution via parse()	Exploitation statusPublic exploit	FixYes	Published03/20/2026	SeverityHigh
`CVE-2026-32141`flatted: Unbounded recursion DoS in parse() revive phase	Exploitation statusPublic exploit	FixYes	Published03/12/2026	SeverityHigh
`CVE-2026-29786`node-tar: Hardlink Path Traversal via Drive-Relative Linkpath	Exploitation statusPublic exploit	FixYes	Published03/07/2026	SeverityHigh
`CVE-2026-27606`Rollup 4 has Arbitrary File Write via Path Traversal	Exploitation statusPublic exploit	FixNot confirmed	Published02/25/2026	SeverityHigh
`CVE-2025-69873`CVE-2025-69873	Exploitation statusPublic exploit	FixYes	Published02/11/2026	SeverityHigh
`CVE-2026-24842`node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal	Exploitation statusPublic exploit	FixNot confirmed	Published01/28/2026	SeverityHigh
`CVE-2026-0603`Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection	Exploitation statusNot known exploited	FixYes	Published01/23/2026	SeverityHigh
`CVE-2026-23950`node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS	Exploitation statusNot known exploited	FixNot confirmed	Published01/20/2026	SeverityHigh
`CVE-2026-23745`node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization	Exploitation statusPublic exploit	FixYes	Published01/16/2026	SeverityHigh
`CVE-2025-58712`Amq: privilege escalation via excessive /etc/passwd permissions	Exploitation statusNot known exploited	FixNot confirmed	Published10/22/2025	SeverityMedium
`CVE-2023-1932`Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss	Exploitation statusNot known exploited	FixNot confirmed	Published11/07/2024	SeverityMedium
`CVE-2023-6717`Keycloak: xss via assertion consumer service url in saml post-binding flow	Exploitation statusNot known exploited	FixYes	Published04/25/2024	SeverityMedium
`CVE-2024-1249`Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos	Exploitation statusNot known exploited	FixYes	Published04/17/2024	SeverityHigh
`CVE-2024-1132`Keycloak: path transversal in redirection validation	Exploitation statusPublic exploit	FixYes	Published04/17/2024	SeverityHigh
`CVE-2024-1300`Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support	Exploitation statusNot known exploited	FixYes	Published04/02/2024	SeverityMedium
`CVE-2024-1023`Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx	Exploitation statusPublic exploit	FixNot confirmed	Published03/27/2024	SeverityMedium
`CVE-2023-4066`Operator: passwords defined in secrets shown in statefulset yaml	Exploitation statusNot known exploited	FixNot confirmed	Published09/27/2023	SeverityMedium
`CVE-2023-4065`Operator: plaintext password in operator log	Exploitation statusNot known exploited	FixNot confirmed	Published09/26/2023	SeverityMedium

63 / 63 Results

All vulnerabilities loaded

Security vulnerabilities in Red Hat AMQ Broker 7

Red Hat AMQ Broker 7

Verify to analyze this security profile

How many security vulnerabilities does Red Hat AMQ Broker 7 have?

Does the latest Red Hat AMQ Broker 7 version have known vulnerabilities?

Run an in-depth assessment with complete web risk management