CVE-2026-5680Undertow-core: undertow: denial of service via websocket permessage-deflate processing Exploitation status Not known exploited Fix Not confirmed Published 08/27/2026 Severity High CVE-2026-24330Wildfly-core: wildfly: arbitrary file read via malicious archive deployment Exploitation status Not known exploited Fix Not confirmed Published 08/11/2026 Severity Medium CVE-2026-24329Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user. Exploitation status Not known exploited Fix Not confirmed Published 08/11/2026 Severity Medium CVE-2026-40984Micrometer HTTP server instrumentations DoS vulnerability Exploitation status Not known exploited Fix Published 06/09/2026 Severity High CVE-2026-42587Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS Exploitation status Public exploit Fix Published 05/13/2026 Severity High CVE-2026-42584Netty: HttpClientCodec response desynchronization Exploitation status Public exploit Fix Published 05/13/2026 Severity High CVE-2026-42579Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) Exploitation status Public exploit Fix Published 05/13/2026 Severity High CVE-2026-42578Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation Exploitation status Public exploit Fix Published 05/13/2026 Severity Low CVE-2026-42581Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization Exploitation status Public exploit Fix Published 05/13/2026 Severity High CVE-2026-42264Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking Exploitation status Public exploit Fix Published 05/08/2026 Severity High CVE-2026-39852Quarkus authorization bypass via semicolon path normalization inconsistency Exploitation status Not known exploited Fix Published 05/05/2026 Severity High CVE-2026-42039Axios: unbounded recursion in toFormData causes DoS via deeply nested request data Exploitation status Public exploit Fix Published 04/24/2026 Severity Medium CVE-2026-42041Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy Exploitation status Public exploit Fix Published 04/24/2026 Severity High CVE-2026-42043Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 Exploitation status Public exploit Fix Published 04/24/2026 Severity High CVE-2026-42044Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` Exploitation status Public exploit Fix Published 04/24/2026 Severity High CVE-2026-42033Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking Exploitation status Public exploit Fix Published 04/24/2026 Severity High CVE-2026-40542Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification Exploitation status Not known exploited Fix Published 04/22/2026 Severity High CVE-2026-40895follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets Exploitation status Not known exploited Fix Published 04/21/2026 Severity Medium CVE-2026-3505Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion. Exploitation status Not known exploited Fix Published 04/15/2026 Severity High CVE-2026-5588PKIX draft CompositeVerifier accepts empty signature sequence as valid. Exploitation status Not known exploited Fix Published 04/15/2026 Severity Medium CVE-2026-5598Non-constant time comparisons risk private key leakage in FrodoKEM. Exploitation status Not known exploited Fix Published 04/15/2026 Severity High CVE-2026-0636LDAP Injection Vulnerability in LDAPStoreHelper.java Exploitation status Not known exploited Fix Published 04/15/2026 Severity Medium CVE-2025-14813GOSTCTR implementation unable to process more than 255 blocks correctly Exploitation status Not known exploited Fix Published 04/15/2026 Severity Critical CVE-2026-2332HTTP Request Smuggling via Chunked Extension Quoted-String Parsing Exploitation status Public exploit Fix Published 04/14/2026 Severity High CVE-2026-40175Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain Exploitation status Public exploit Fix Published 04/10/2026 Severity High CVE-2025-62718Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF Exploitation status Public exploit Fix Published 04/09/2026 Severity Medium CVE-2025-58713Rhpam: privilege escalation via excessive /etc/passwd permissions Exploitation status Not known exploited Fix Not confirmed Published 04/08/2026 Severity Medium CVE-2026-4800lodash vulnerable to Code Injection via `_.template` imports key names Exploitation status Not known exploited Fix Published 03/31/2026 Severity High CVE-2026-33941Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33940Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33939Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33938Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33937Handlebars.js has JavaScript Injection via AST Type Confusion Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity Critical CVE-2026-33896Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33895Forge has signature forgery in Ed25519 due to missing S > L check Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33894Forge has signature forgery in RSA-PKCS due to ASN.1 extra field Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33891Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33871Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass Exploitation status Not known exploited Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33870Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-28369Undertow: undertow: request smuggling via malformed http request headers Exploitation status Not known exploited Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-28367Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Exploitation status Not known exploited Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-28368Undertow: undertow: request smuggling via inconsistent header parsing Exploitation status Not known exploited Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-4926path-to-regexp vulnerable to Denial of Service via sequential optional groups Exploitation status Not known exploited Fix Published 03/26/2026 Severity High CVE-2025-67030CVE-2025-67030 Exploitation status Not known exploited Fix Not confirmed Published 03/25/2026 Severity High CVE-2026-3260CVE-2026-3260 Exploitation status Not confirmed Fix Not confirmed Published 03/24/2026 Severity Unknown CVE-2026-33228flatted: Prototype Pollution via parse() Exploitation status Public exploit Fix Published 03/20/2026 Severity High CVE-2026-32141flatted: Unbounded recursion DoS in parse() revive phase Exploitation status Public exploit Fix Published 03/12/2026 Severity High CVE-2026-29786node-tar: Hardlink Path Traversal via Drive-Relative Linkpath Exploitation status Public exploit Fix Published 03/07/2026 Severity High CVE-2026-1605CVE-2026-1605 Exploitation status Not known exploited Fix Published 03/05/2026 Severity High CVE-2026-27446Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Exploitation status Not known exploited Fix Published 03/04/2026 Severity Critical CVE-2026-27830c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property Exploitation status Not known exploited Fix Not confirmed Published 02/26/2026 Severity High CVE-2026-27727mchange-commons-java: Remote Code Execution via JNDI Reference Resolution Exploitation status Public exploit Fix Not confirmed Published 02/25/2026 Severity High CVE-2025-69873CVE-2025-69873 Exploitation status Public exploit Fix Published 02/11/2026 Severity High CVE-2026-25639Axios affected by Denial of Service via __proto__ Key in mergeConfig Exploitation status Not known exploited Fix Published 02/09/2026 Severity High CVE-2024-4027Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks Exploitation status Not known exploited Fix Not confirmed Published 01/30/2026 Severity High CVE-2026-24842node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal Exploitation status Public exploit Fix Not confirmed Published 01/28/2026 Severity High CVE-2026-0603Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection Exploitation status Not known exploited Fix Published 01/23/2026 Severity High CVE-2025-13465Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions Exploitation status Not known exploited Fix Published 01/21/2026 Severity Medium CVE-2026-23950node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS Exploitation status Not known exploited Fix Not confirmed Published 01/20/2026 Severity High CVE-2026-23745node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization Exploitation status Public exploit Fix Published 01/16/2026 Severity High CVE-2026-22029React Router vulnerable to XSS via Open Redirects Exploitation status Not known exploited Fix Not confirmed Published 01/10/2026 Severity High CVE-2025-12543Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf Exploitation status Public exploit Fix Not confirmed Published 01/07/2026 Severity Critical CVE-2024-3884Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded Exploitation status Not known exploited Fix Not confirmed Published 12/03/2025 Severity High CVE-2025-9784Undertow: undertow madeyoureset http/2 ddos vulnerability Exploitation status Not known exploited Fix Published 09/02/2025 Severity High CVE-2025-23368Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli Exploitation status Not known exploited Fix Not confirmed Published 03/04/2025 Severity High CVE-2024-11831Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript Exploitation status Not known exploited Fix Published 02/10/2025 Severity Medium CVE-2025-23367Org.wildfly.core:wildfly-server: wildfly improper rbac permission Exploitation status Not known exploited Fix Published 01/30/2025 Severity Medium CVE-2024-12397Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling Exploitation status Not known exploited Fix Published 12/12/2024 Severity High CVE-2023-4639Undertow: cookie smuggling/spoofing Exploitation status Not known exploited Fix Not confirmed Published 11/17/2024 Severity High CVE-2023-1932Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss Exploitation status Not known exploited Fix Not confirmed Published 11/07/2024 Severity Medium CVE-2023-6841Keycloak: amount of attributes per object is not limited and it may lead to dos Exploitation status Not known exploited Fix Published 09/10/2024 Severity High CVE-2024-7885Undertow: improper state management in proxy protocol parsing causes information leakage Exploitation status Not known exploited Fix Published 08/21/2024 Severity High CVE-2024-3653Undertow: learningpushhandler can lead to remote memory dos attacks Exploitation status Not known exploited Fix Published 07/08/2024 Severity Medium CVE-2024-5971Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket Exploitation status Not known exploited Fix Published 07/08/2024 Severity High CVE-2024-6162Undertow: url-encoded request path information can be broken on ajp-listener Exploitation status Not known exploited Fix Published 06/20/2024 Severity High CVE-2024-4029Wildfly: no timeout for eap management interface may lead to denial of service (dos) Exploitation status Not known exploited Fix Published 05/02/2024 Severity Medium CVE-2023-6717Keycloak: xss via assertion consumer service url in saml post-binding flow Exploitation status Not known exploited Fix Published 04/25/2024 Severity Medium CVE-2023-5675Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used. Exploitation status Not known exploited Fix Published 04/25/2024 Severity Medium CVE-2024-1249Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos Exploitation status Not known exploited Fix Published 04/17/2024 Severity High CVE-2024-1132Keycloak: path transversal in redirection validation Exploitation status Public exploit Fix Published 04/17/2024 Severity High CVE-2024-1300Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support Exploitation status Not known exploited Fix Published 04/02/2024 Severity Medium CVE-2024-1023Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx Exploitation status Public exploit Fix Not confirmed Published 03/27/2024 Severity Medium CVE-2023-5685Xnio: stackoverflowexception when the chain of notifier states becomes problematically big Exploitation status Not known exploited Fix Not confirmed Published 03/22/2024 Severity High CVE-2024-1635Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol Exploitation status Not known exploited Fix Not confirmed Published 02/19/2024 Severity High CVE-2024-1459Undertow: directory traversal vulnerability Exploitation status Not known exploited Fix Published 02/12/2024 Severity Medium CVE-2023-6291Keycloak: redirect_uri validation bypass Exploitation status Not known exploited Fix Not confirmed Published 01/26/2024 Severity High CVE-2023-5236Infinispan: circular reference on marshalling leads to dos Exploitation status Not known exploited Fix Not confirmed Published 12/18/2023 Severity Medium CVE-2023-5379Undertow: ajp request closes connection exceeding maxrequestsize Exploitation status Not known exploited Fix Not confirmed Published 12/12/2023 Severity High CVE-2023-3223Undertow: outofmemoryerror due to @multipartconfig handling Exploitation status Not known exploited Fix Not confirmed Published 09/27/2023 Severity High CVE-2022-4245Codehaus-plexus: xml external entity (xxe) injection Exploitation status Not known exploited Fix Not confirmed Published 09/25/2023 Severity Medium CVE-2022-4244Codehaus-plexus: directory traversal Exploitation status Public exploit Fix Not confirmed Published 09/25/2023 Severity High CVE-2023-4853Quarkus: http security policy bypass Exploitation status Not confirmed Fix Not confirmed Published 09/20/2023 Severity High CVE-2022-1415Drools: unsafe data deserialization in streamutils Exploitation status Not known exploited Fix Not confirmed Published 09/11/2023 Severity High 
