CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,436
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product redhat:jboss_data_grid. Show all products

45 CVEs, showing 1 to 45
CVESeverityTitlePublished
CVE-2019-10219
Healthcare
Medium 6.5A vulnerability was found in Hibernate-Validator.
Assigned by redhat
Nov 8, 2019
CVE-2019-14892High 7.5A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2…
Assigned by redhat
Mar 2, 2020
CVE-2021-4104
Healthcare
High 7.5Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
Assigned by apache
Dec 14, 2021
CVE-2022-1271High 8.8An arbitrary file write vulnerability was found in GNU gzip's zgrep utility.
Assigned by redhat
Aug 31, 2022
CVE-2023-44487
Known exploited
High 7.5The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Assigned by mitre
Oct 10, 2023
CVE-2024-11831Medium 5.4Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
Assigned by redhat
Feb 10, 2025
CVE-2025-23368High 8.1Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli
Assigned by redhat
Mar 4, 2025
CVE-2025-9784High 7.5Undertow: undertow madeyoureset http/2 ddos vulnerability
Assigned by redhat
Sep 2, 2025
CVE-2024-3884High 7.5Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
Assigned by redhat
Dec 3, 2025
CVE-2025-12543Critical 9.6Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
Assigned by redhat
Jan 7, 2026
CVE-2025-13465Medium 6.9Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Assigned by openjs
Jan 21, 2026
CVE-2026-28368High 8.7Undertow: undertow: request smuggling via inconsistent header parsing
Assigned by redhat
Mar 27, 2026
CVE-2026-28367High 8.7Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
Assigned by redhat
Mar 27, 2026
CVE-2026-28369High 8.7Undertow: undertow: request smuggling via malformed http request headers
Assigned by redhat
Mar 27, 2026
CVE-2026-4800High 8.1lodash vulnerable to Code Injection via `_.template` imports key names
Assigned by openjs
Mar 31, 2026
CVE-2026-34197
Known exploited
High 8.8Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Assigned by apache
Apr 7, 2026
CVE-2026-18569Low 3.7Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens
Assigned by redhat
Aug 4, 2026
CVE-2026-16443High 7.4Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
Assigned by redhat
Aug 5, 2026
CVE-2026-15573High 8.1Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
Assigned by redhat
Aug 5, 2026
CVE-2026-16102High 8.1Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
Assigned by redhat
Aug 5, 2026
CVE-2026-16071Medium 5.4Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary
Assigned by redhat
Aug 5, 2026
CVE-2026-16100Medium 6.5Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text
Assigned by redhat
Aug 5, 2026
CVE-2026-16442High 7.4Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
Assigned by redhat
Aug 5, 2026
CVE-2026-15565High 7.5Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method
Assigned by redhat
Aug 11, 2026
CVE-2026-14180Medium 5.3Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap
Assigned by redhat
Aug 11, 2026
CVE-2026-15571High 7.3Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client
Assigned by redhat
Aug 18, 2026
CVE-2026-19611High 7.4Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
Assigned by redhat
Aug 20, 2026
CVE-2026-5680High 7.5Undertow-core: undertow: denial of service via websocket permessage-deflate processing
Assigned by redhat
Aug 27, 2026
CVE-2026-18212High 7.5Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
Assigned by redhat
Sep 16, 2026
CVE-2026-17526High 7.2Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts
Assigned by redhat
Sep 16, 2026
CVE-2026-93488High 7.5Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams
Assigned by redhat
Sep 18, 2026
CVE-2026-93491High 7.5Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue
Assigned by redhat
Sep 18, 2026
CVE-2026-93492Medium 5.3Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size
Assigned by redhat
Sep 18, 2026
CVE-2026-93558High 7.5Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service
Assigned by redhat
Sep 18, 2026
CVE-2026-93565High 7.5Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte
Assigned by redhat
Sep 18, 2026
CVE-2026-93566Medium 6.5Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
Assigned by redhat
Sep 18, 2026
CVE-2026-10832Medium 5.9Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload
Assigned by redhat
Sep 18, 2026
CVE-2026-93567High 7.5Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority
Assigned by redhat
Sep 18, 2026
CVE-2026-93569High 8.2Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority
Assigned by redhat
Sep 18, 2026
CVE-2026-85511Medium 4.2Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2
Assigned by redhat
Sep 18, 2026
CVE-2026-93568High 7.5Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests
Assigned by redhat
Sep 18, 2026
CVE-2026-93573Medium 6.5Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling
Assigned by redhat
Sep 18, 2026
CVE-2026-93579Medium 6.5Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)
Assigned by redhat
Sep 18, 2026
CVE-2026-93574Medium 6.5Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing
Assigned by redhat
Sep 18, 2026
CVE-2026-93562Medium 6.5Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling
Assigned by redhat
Sep 18, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.