en
Severity across 29 analyzed records
A short verification protects source data and prevents automated AI requests.
As of 09/11/2026, within CyStack's analyzed data, RHEL-8 based Middleware Containers has 0 security vulnerabilities published in the last 90 days. Of these, 0 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of RHEL-8 based Middleware Containers and determine which vulnerabilities affect that version.
| CVE | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-4786Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() | Exploitation statusNot known exploited | FixYes | Published04/13/2026 | SeverityHigh |
CVE-2026-6100Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure | Exploitation statusNot known exploited | FixYes | Published04/13/2026 | SeverityCritical |
CVE-2026-5121Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing | Exploitation statusNot known exploited | FixNot confirmed | Published03/30/2026 | SeverityCritical |
CVE-2026-4519webbrowser.open() allows leading dashes in URLs | Exploitation statusNot known exploited | FixYes | Published03/20/2026 | SeverityHigh |
CVE-2026-4424Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing | Exploitation statusNot known exploited | FixNot confirmed | Published03/19/2026 | SeverityHigh |
CVE-2026-27135nghttp2 Denial of service: Assertion failure due to the missing state validation | Exploitation statusNot known exploited | FixNot confirmed | Published03/18/2026 | SeverityHigh |
CVE-2026-3497CVE-2026-3497 | Exploitation statusNot known exploited | FixYes | Published03/12/2026 | SeverityLow |
CVE-2025-14831Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification | Exploitation statusNot known exploited | FixNot confirmed | Published02/09/2026 | SeverityMedium |
CVE-2025-9820Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function | Exploitation statusNot known exploited | FixNot confirmed | Published01/26/2026 | SeverityMedium |
CVE-2025-6020Linux-pam: linux-pam directory traversal | Exploitation statusNot known exploited | FixYes | Published06/17/2025 | SeverityHigh |
CVE-2025-4057Activemq-artemis-operator: amq broker operator starting credentials reuse | Exploitation statusNot known exploited | FixYes | Published05/26/2025 | SeverityMedium |
CVE-2024-10234Wildfly: wildfly vulnerable to cross-site scripting (xss) | Exploitation statusNot known exploited | FixYes | Published10/22/2024 | SeverityMedium |
CVE-2024-8883Keycloak: vulnerable redirect uri validation results in open redirec | Exploitation statusNot known exploited | FixYes | Published09/19/2024 | SeverityMedium |
CVE-2024-8698Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak | Exploitation statusNot known exploited | FixYes | Published09/19/2024 | SeverityHigh |
CVE-2024-7341Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters | Exploitation statusNot known exploited | FixYes | Published09/09/2024 | SeverityHigh |
CVE-2024-4629Keycloak: potential bypass of brute force protection | Exploitation statusNot known exploited | FixNot confirmed | Published09/03/2024 | SeverityMedium |
CVE-2024-5967Keycloak: leak of configured ldap bind credentials through the keycloak admin console | Exploitation statusNot known exploited | FixYes | Published06/18/2024 | SeverityLow |
CVE-2024-4540Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie | Exploitation statusNot known exploited | FixNot confirmed | Published06/03/2024 | SeverityHigh |
CVE-2023-6544Keycloak: authorization bypass | Exploitation statusNot known exploited | FixYes | Published04/25/2024 | SeverityMedium |
CVE-2023-6484Keycloak: log injection during webauthn authentication or registration | Exploitation statusNot known exploited | FixYes | Published04/25/2024 | SeverityMedium |
CVE-2024-1249Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos | Exploitation statusNot known exploited | FixYes | Published04/17/2024 | SeverityHigh |
CVE-2024-1132Keycloak: path transversal in redirection validation | Exploitation statusPublic exploit | FixYes | Published04/17/2024 | SeverityHigh |
CVE-2024-1635Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol | Exploitation statusNot known exploited | FixNot confirmed | Published02/19/2024 | SeverityHigh |
CVE-2023-6291Keycloak: redirect_uri validation bypass | Exploitation statusNot known exploited | FixNot confirmed | Published01/26/2024 | SeverityHigh |
CVE-2023-2585Keycloak: client access via device auth request spoof | Exploitation statusNot confirmed | FixNot confirmed | Published12/21/2023 | SeverityLow |
CVE-2023-6927Keycloak: open redirect via "form_post.jwt" jarm response mode | Exploitation statusNot confirmed | FixNot confirmed | Published12/18/2023 | SeverityMedium |
CVE-2023-6134Keycloak: reflected xss via wildcard in oidc redirect_uri | Exploitation statusNot confirmed | FixNot confirmed | Published12/14/2023 | SeverityMedium |
CVE-2023-6563Keycloak: offline session token dos | Exploitation statusNot confirmed | FixNot confirmed | Published12/14/2023 | SeverityHigh |
CVE-2023-2422Keycloak: oauth client impersonation | Exploitation statusNot known exploited | FixNot confirmed | Published10/04/2023 | SeverityMedium |
CVE-2023-4066Operator: passwords defined in secrets shown in statefulset yaml | Exploitation statusNot known exploited | FixNot confirmed | Published09/27/2023 | SeverityMedium |
CVE-2023-3223Undertow: outofmemoryerror due to @multipartconfig handling | Exploitation statusNot known exploited | FixNot confirmed | Published09/27/2023 | SeverityHigh |
CVE-2023-4065Operator: plaintext password in operator log | Exploitation statusNot known exploited | FixNot confirmed | Published09/26/2023 | SeverityMedium |
CVE-2022-4039Rhsso-container-image: unsecured management interface exposed to adjecent network | Exploitation statusNot known exploited | FixNot confirmed | Published09/22/2023 | SeverityHigh |
CVE-2022-3916Keycloak: session takeover with oidc offline refreshtokens | Exploitation statusNot known exploited | FixNot confirmed | Published09/20/2023 | SeverityMedium |
CVE-2022-1438Keycloak: xss on impersonation under specific circumstances | Exploitation statusNot known exploited | FixNot confirmed | Published09/20/2023 | SeverityMedium |
CVE-2023-4853Quarkus: http security policy bypass | Exploitation statusNot confirmed | FixNot confirmed | Published09/20/2023 | SeverityHigh |
CVE-2023-1108Undertow: infinite loop in sslconduit during close | Exploitation statusNot known exploited | FixNot confirmed | Published09/14/2023 | SeverityHigh |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
