Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding

Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role

Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean

Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

Jastow: jastow cross-site scripting attack due to unsanitized uri

Org.wildfly.core:wildfly-server: wildfly improper rbac permission

Jberet: jberet-core logging database credentials

Infinispan: circular reference on marshalling leads to dos

Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss

Narayana: deadlock via multiple join requests sent to lra coordinator

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

Wildfly-core: path traversal on wildfly domain controller

Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

Elytron-oidc-client: oidc authorization code injection

Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal