| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-15563 | 7.4 | A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations. | 2026-11-01 02:17:01 | 2026-08-11 09:17:13 |
| CVE-2026-120192 | 5.0 | A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to lau | 2026-11-01 02:16:59 | 2026-11-01 02:16:59 |
| CVE-2026-86404 | 8.8 | EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, | 2026-11-01 01:17:33 | 2026-09-07 12:17:21 |
| CVE-2026-15567 | 7.5 | A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size. | 2026-11-01 01:17:32 | 2026-08-11 09:17:13 |
| CVE-2026-15565 | 7.5 | A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authe | 2026-11-01 01:17:30 | 2026-08-11 09:17:13 |
| CVE-2026-15562 | 7.5 | A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of servic | 2026-11-01 01:17:27 | 2026-08-11 09:17:13 |
| CVE-2026-15561 | 7.5 | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, an | 2026-11-01 01:17:25 | 2026-08-11 09:17:12 |
| CVE-2026-15560 | 8.1 | when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server J | 2026-11-01 01:17:23 | 2026-08-11 09:17:12 |
| CVE-2026-15556 | 8.1 | A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected applica | 2026-11-01 01:17:22 | 2026-08-11 09:17:12 |
| CVE-2026-15555 | 8.8 | A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster | 2026-11-01 01:17:21 | 2026-08-11 09:17:12 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39839
Zapisa po stranici: