Vulnerabilities of Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-18963	A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity…	9.1 Critical	Aug 18, 2026
CVE-2026-40982	Spring Cloud Config allows applications to serve arbitrary text and binary files through the…	9.1 Critical	May 7, 2026
CVE-2026-40976	In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all…	9.1 Critical	Apr 27, 2026
CVE-2026-6951	Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete…	9.8 Critical	Apr 25, 2026
CVE-2026-40478	Thymeleaf is a server-side Java template engine for web and standalone environments	9.1 Critical	Apr 17, 2026
CVE-2026-40477	Thymeleaf is a server-side Java template engine for web and standalone environments	9.1 Critical	Apr 17, 2026
CVE-2025-14813	: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc	9.3 Critical	Apr 15, 2026
CVE-2026-33701	OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java	9.3 Critical	Mar 27, 2026
CVE-2026-28292	`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0…	9.8 Critical	Mar 10, 2026
CVE-2026-27446	Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis	9.3 Critical	Mar 4, 2026
CVE-2025-61686	React Router is a router for React	9.1 Critical	Jan 10, 2026
CVE-2025-70974	Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key…	10.0 Critical	Jan 9, 2026
CVE-2025-12543	Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf	9.6 Critical	Jan 7, 2026

Other Red Hat products