Picketlink-federation: auth bypass in picketlink saml unsolicited-response

Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Undertow: undertow: request smuggling via malformed http request headers

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

Undertow: undertow: request smuggling via inconsistent header parsing

Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name

Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default

Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)

Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)

Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos

Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits

Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder

Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

Undertow-core: oom via missing limits in chunked trailer in eap's undertow

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Undertow: undertow madeyoureset http/2 ddos vulnerability

Smallrye-fault-tolerance: smallrye fault tolerance

Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding

Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization